@unbrained/pm-cli 2026.8.29 → 2026.8.31

package/docs/SDK.md

@@ -137,7 +137,7 @@ List consumers can inspect `LIST_COMMAND_DEFAULT_PROJECTIONS` instead of
 copying command-specific defaults. Every compact or field-projected list result
 now echoes the applied `projection`; `brief` remains distinct from `compact`,
 and `DEFAULT_COMPACT_LIST_FIELDS` / `BRIEF_LIST_FIELDS` provide the canonical
-field sets. `pm contracts --command list-open --flags-only --json` includes the
+field sets. `pm contracts --command list --flags-only --json` includes the
 same per-command projection surface.
 
 ### Public-surface compatibility
@@ -336,7 +336,7 @@ Command/action contract exports:
 - Annotation and relationship option/result contracts: `CommentsCommandOptions` / `CommentsResult`, `NotesCommandOptions` / `NotesResult`, `LearningsCommandOptions` / `LearningsResult`, `FilesCommandOptions` / `FilesResult`, `FilesDiscoverOptions` / `FilesDiscoverResult`, `DocsCommandOptions` / `DocsResult`, `DepsCommandOptions` / `DepsResult`, `AppendCommandOptions` / `AppendResult`
 - Annotation kernel primitives: `resolveAnnotationInput`, `runAnnotationCommand`, `resolveAnnotationIndex`, `parseAnnotationTextInput`, `limitAnnotationEntries`, `readAnnotationEntries`, `wrapOwnershipConflict`, `isErrnoError`, and their typed input/config/result contracts
 - Linked-resource kernel primitives: `runFiles`, `runFilesDiscover`, `runDocs`, `runDeps`, `runLinkedArtifacts`, `assertLinkedArtifactMutationIsUnambiguous`, parsing/normalization/path-validation helpers, and their typed contracts. The CLI files/docs/deps modules are presentation-only re-exports of these SDK implementations. A transaction that resolves one path into both its add and remove sets fails before item or history mutation; split an intentional replacement into two commands so its context remains explicit.
-- Actionability primitives: `collectBlockedByIds`, `resolveItemBlockers`, `collectDependencyBlockedIds`, and `computeActionabilityReport` expose the same edge-aware blocked/ready definition used by `pm next`, `pm context`, and `pm list-blocked`. Embedded schedulers can therefore classify custom lifecycle schemas without importing CLI or core modules.
+- Actionability primitives: `collectBlockedByIds`, `resolveItemBlockers`, `collectDependencyBlockedIds`, and `computeActionabilityReport` expose the same edge-aware blocked/ready definition used by `pm next`, `pm context`, and `pm list --status blocked`. Embedded schedulers can therefore classify custom lifecycle schemas without importing CLI or core modules.
 - Dependency-governance primitives: `collectDanglingDependencyReferences`, `collectMissingDependencyTargetIds`, and `assembleWorkspaceRelationshipGraph` normalize hierarchy, scalar blockers, and structured dependencies into one graph while partitioning missing targets into actionable active holders, informational terminal-history holders, and the legacy `no-active-blocker` sentinel without mutating stored history.
 - Relationship graph primitives: `RelationshipKindRegistry`, `createRelationshipKindRegistry`, `assertRelationshipEdgeAllowed`, `RelationshipGraph`, `RelationshipEventLog`, `RelationshipEventStore`, `planRelationshipEventBackfill`, `buildRelationshipContext`, `buildDepsRelationshipContext`, `hierarchyAncestors`, `hierarchyDescendants`, `orderingPredecessors`, `orderingSuccessors`, `enumerateRelationshipPaths`, `auditWorkspaceRelationshipGraph`, `isOrderingRelationshipKind`, and `dependencyToRelationship` provide application-defined edge semantics, durable replay, deterministic legacy migration, bounded semantic traversal, policy-aware governance, and explainable context queries. Mutation adapters should call `assertRelationshipEdgeAllowed` with the active registry before persistence; it resolves aliases and honors custom `allowSelf` definitions while built-in self edges fail before item or history writes. `RelationshipEventLog.stream/project` and their durable-store equivalents page immutable prefixes and fold them into deterministic application state with exact version, processed-count, and as-of metadata. `RelationshipEventStore.appendBatch` validates a complete import under one cross-process lock and atomically publishes it; `skip_identical` resume mode rejects same-id semantic collisions. `RelationshipGraphAdapter`, `createRelationshipGraphSnapshot`, `syncRelationshipGraphAdapter`, `loadRelationshipGraphAdapter`, and `federateRelationshipGraphSnapshots` form the backend-neutral content-addressed projection boundary for database or remote graph packages. `MemoryRelationshipGraphAdapter`, `assertRelationshipGraphAdapterConformance`, and `createRelationshipGraphScaleFixture` give package authors a reference implementation, reusable compatibility contract, and lazy deterministic fixtures through one million nodes. See [Relationship graph semantics](RELATIONSHIP_GRAPH.md).
 - Built-in `recurs_from` records that the source is a later occurrence of the target. Its registry contract is directed, `source_after_target`, non-ordering, many-to-many, and persistent across terminal lifecycle states. Local mutation paths enforce strictly later source `created_at` metadata before item or history persistence and return structured source/target evidence when chronology is equal, reversed, or unverifiable. It therefore connects an incident family for traversal and analytics without reclassifying `supersedes` replacements or `duplicate_of` identity collapse.
@@ -1642,7 +1642,7 @@ const certified = certifyCompleteListResult(candidate);
 
 `PmCompleteListValidationError.receipt` lists every failed invariant and carries
 the exact recovery command
-`pm list-all --full --strict-read --no-truncate --output-budget unbounded --json`.
+`pm list --all --full --strict-read --no-truncate --output-budget unbounded --json`.
 The helper never infers completeness from a large limit: derived-index reads,
 terminal-state filtering, duplicate ids, cursor/session projection, compaction,
 and any omission receipt all prevent certification.

package/docs/TESTING.md

@@ -8,10 +8,11 @@ Tracked implementation updates: [pm-52eh](../.agents/pm/features/pm-52eh.toon),
 
 - Unit and integration tests must not read or write real `.agents/pm` data.
 - Prefer `node scripts/run-tests.mjs ...` because it creates sandboxed `PM_PATH` and `PM_GLOBAL_PATH`.
-- Linked tests added through `pm test` should use sandbox-safe commands.
-  Package-manager scripts such as `pnpm test` are allowed because linked-test
-  execution injects isolated `PM_PATH` and `PM_GLOBAL_PATH`; direct runners such
-  as `vitest` still need `node scripts/run-tests.mjs ...` or inline sandbox env.
+- Linked-test execution injects isolated `PM_PATH` and `PM_GLOBAL_PATH` for
+  every command and applies stored-command provenance checks before process
+  creation. Direct runners are accepted; prefer
+  `node scripts/run-tests.mjs ...` when the repository provides it because the
+  wrapper also reproduces build, coverage, and cleanup policy.
 - Run linked tests before closing the item that owns the work.
 
 Tracked documentation work: [pm-u9d0](../.agents/pm/epics/pm-u9d0.toon).
@@ -62,7 +63,8 @@ and stable error-code drift across the aggregate and every narrow SDK
 entrypoint. The performance gates protect entrypoint import cost and one-item
 CLI cold-start overhead without touching the repository tracker.
 
-`pnpm lint` is the local CodeFactor parity check. It layers ESLint rules for
+`pnpm lint` and `pnpm quality:static` are the same canonical local static gate.
+The gate layers ESLint rules for
 shipped source, package, plugin, and script surfaces that match the CodeFactor
 maintainability findings this repo tracks (`complexity`,
 `no-unsafe-optional-chaining`, and the relevant `eslint-plugin-unicorn`
@@ -193,7 +195,7 @@ Fixture source:
 Local run:
 
 ```bash
-pm install search-advanced --project
+pm package install search-advanced --project
 pm reindex --mode keyword --eval --eval-fixtures tests/search-eval/golden-queries.json --json
 ```
 
@@ -385,12 +387,12 @@ correction; executable retry argv is never collection-truncated. The
 missing-probe negative control and the authoritative tracker-state snapshot
 prove that the corpus cannot silently shrink or turn a refusal into a mutation.
 
-The gate derives every supported harness, model, session, and provenance
-environment key from the SDK-owned harness descriptor registry. It deletes
-those host inputs before each fixture invocation, then supplies only the
-fixture's deterministic author and isolated tracker settings. Unrelated host
-environment values remain available, so the test process stays representative
-without allowing the launching agent or CI harness to change measured output.
+The gate starts every fixture command from a closed environment allowlist. It
+retains only declared process-portability inputs such as `PATH`, temporary and
+home roots, and Windows process-launch variables, then supplies fixed locale,
+timezone, author, telemetry, and isolated tracker settings. Undeclared host
+values cannot reach measured output, including future harness variables that
+the descriptor registry does not yet know about.
 
 ## Linked Tests
 
@@ -493,6 +495,13 @@ trusted legacy command.
 These pre-execution refusals use the `trust_refusal` failure category, separate
 from command or assertion failures.
 
+Command-string shape is intentionally not treated as a security boundary.
+Direct `node --test`, Vitest, package-manager, shell-wrapped, and non-Node
+runners are accepted consistently because the runtime injects tracker
+isolation for all of them. `classifyLinkedTestCommandSafety` exposes the same
+SDK policy to package hosts and returns advisory runner classification;
+provenance review and acknowledgment remain the execution trust boundary.
+
 Choose one explicit recovery:
 
 ```bash
@@ -577,7 +586,7 @@ Linked tests can include assertion metadata:
 
 ```bash
 pm test <item-id> --add \
-  command="pm list-open --json",timeout_seconds=120,assert_json_field_gte=count:0
+  command="pm list --status open --json",timeout_seconds=120,assert_json_field_gte=count:0
 ```
 
 Common assertion keys include:
@@ -614,7 +623,7 @@ exemplar for background run management. Install it in an isolated project when
 validating package-provided test-run surfaces:
 
 ```bash
-pm install linked-test-adapters --project
+pm package install linked-test-adapters --project
 pm package doctor --project --detail deep --trace
 pm test-runs list --json
 ```

package/docs/WORKSPACE_POSITION_AND_LIFECYCLE.md

@@ -0,0 +1,113 @@
+# Workspace Position and Lifecycle Roles
+
+Tracker references: [pm-bq0ii8](../.agents/pm/features/pm-bq0ii8.toon), [pm-0mhspz](../.agents/pm/issues/pm-0mhspz.toon)
+
+## Agent Quick Context
+
+Project management is context management. A project status must therefore be both semantically classifiable and operationally safe to merge. Two SDK-owned primitives provide that baseline:
+
+- lifecycle roles make custom workflow states participate consistently in `next`, `context`, list aliases, validation, and health;
+- workspace position combines merge-fence, pending merge-receipt, and append-only history evidence into one bounded readiness state and one next action.
+
+## Role-Safe Custom Statuses
+
+Every newly registered custom status requires at least one lifecycle role:
+
+```bash
+pm schema add-status review --role active
+pm schema add-status waiting_external --role blocked
+pm schema add-status abandoned --role terminal --role terminal_canceled
+```
+
+The supported roles are `draft`, `active`, `blocked`, `terminal`, `terminal_done`, `terminal_canceled`, `default_open`, `default_close`, and `default_cancel`. A status may have multiple roles when it is both a lifecycle member and a workflow default.
+
+An existing status can be updated without repeating `--role`; its registered role is preserved. New roleless statuses and explicit empty role lists are refused. This prevents an item from being accepted into storage but disappearing from every actionable read.
+
+Role-derived behavior is shared:
+
+- `pm next` treats every `active` status as actionable unless dependency or blocker rules exclude it.
+- `pm list --status open` and the deprecated `pm list-open` alias include active statuses other than the configured `in_progress_status`.
+- `pm list --status in_progress` and `pm list-in-progress` select the configured in-progress workflow anchor.
+- `pm context` guarantees `summary.active_items = summary.open + summary.in_progress`; custom active statuses cannot disappear from that accounting.
+- `pm list-blocked` continues to combine blocked-role status and unresolved dependency evidence.
+
+Legacy hand-edited or older trackers may still contain roleless definitions. Both commands surface the same warning and bounded affected-item evidence:
+
+```bash
+pm health --check-only --full --json
+pm validate --check-lifecycle --json
+```
+
+Look for `schema_status_missing_lifecycle_role:<count>` and
+`lifecycle_status_roles`. Diagnostics retain `roleless_status_count` while
+bounding both status and affected-item ID samples with explicit truncation
+flags. Repair the schema by re-registering each status with its intended role
+before making workflow decisions.
+
+## One Workspace Position Read
+
+Run:
+
+```bash
+pm workspace position
+pm workspace position --json
+```
+
+The read requires no feature flag or session state. It reports:
+
+- whether the committed `.gitattributes` merge fence matches the project schema;
+- whether this clone has all required field-aware Git driver definitions;
+- pending merge decisions, lossless receipt count, and invalid evidence count;
+- bounded append-only history-drift counts and affected item IDs;
+- one deterministic `state` and one `next_action.command`.
+
+The next action always pins the inspected tracker with `--pm-path` and uses the
+SDK's platform-aware command renderer. Paths with spaces or shell-significant
+characters are therefore copy-safe on both POSIX shells and Windows command
+lines, while package consumers can reuse `renderPmCommand` for their own
+tokenized recovery actions.
+
+Recovery precedence is intentional:
+
+| State                           | Next action                                | Why it comes first                                                        |
+| ------------------------------- | ------------------------------------------ | ------------------------------------------------------------------------- |
+| `merge_evidence_invalid`        | `pm merge report`                          | Untrusted evidence must be inspected before it can drive repair.          |
+| `history_evidence_invalid`      | `pm validate --check-history-drift --full` | Required history evidence could not be interpreted safely.                |
+| `merge_reconciliation_required` | `pm merge reconcile`                       | Pending scalar decisions can explain and settle merge-created divergence. |
+| `history_repair_required`       | `pm history-repair --all`                  | Remaining append-only drift needs an audited re-anchor.                   |
+| `merge_fence_unprepared`        | `pm merge install`                         | The committed fence or clone-local drivers are absent or drifted.         |
+| `ready`                         | none                                       | All included readiness predicates passed.                                 |
+
+`pm health --strict-exit` also treats missing clone-local merge drivers as blocking. Default health remains advisory for never-installed drivers so ordinary diagnostics retain backward compatibility.
+
+## SDK and Generic Runtime
+
+Package authors can use the same implementation as the CLI:
+
+```ts
+import {
+  inspectStatusRoleAssignments,
+  readWorkspacePosition,
+  resolveRuntimeStatusRegistry,
+} from "@unbrained/pm-cli/sdk";
+
+const position = await readWorkspacePosition({ path: ".agents/pm" });
+if (!position.ok) {
+  console.log(position.next_action.command);
+}
+```
+
+The generic SDK/MCP action is `workspace` with `subcommand: "position"`. Snapshot operations remain `subcommand: "snapshot"` plus `snapshotAction`. Presentation layers do not duplicate readiness or lifecycle classification logic.
+
+## Operational Sequence
+
+On a fresh clone:
+
+```bash
+npm install -g .
+pm merge install
+pm workspace position --json
+pm health --strict-exit --full --json
+```
+
+After a branch merge, run workspace position before claiming that the tracker is safe. Follow only its selected next action, rerun the read, and continue until `state` is `ready`. This keeps remediation evidence ordered, token-bounded, and reproducible.

package/docs/examples/policy-restricted-extension/README.md

@@ -26,7 +26,7 @@ cp -R docs/examples/policy-restricted-extension .agents/pm/extensions/policy-res
 cd .agents/pm/extensions/policy-restricted-extension
 npm install
 cd -
-pm extension --install --project .agents/pm/extensions/policy-restricted-extension
+pm package install --project .agents/pm/extensions/policy-restricted-extension
 ```
 
 Add policy in `.agents/pm/settings.json`:
@@ -68,7 +68,7 @@ Add policy in `.agents/pm/settings.json`:
 Then validate:
 
 ```bash
-pm extension --doctor --project --detail summary
+pm package doctor --project --detail summary
 pm policy demo
 ```
 

package/docs/examples/starter-extension/README.md

@@ -38,7 +38,7 @@ cd -
 
 # 3) Install/activate in project scope (package-first vocabulary;
 #    `pm extension --install` remains as a compatibility form)
-pm install .agents/pm/extensions/starter-extension --project
+pm package install .agents/pm/extensions/starter-extension --project
 
 # 4) Run a starter command
 pm starter ping --name "agent"

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 353
+- Catalog error codes: 354
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 334
-- Coverage fraction: 0.053824
+- Uncovered error codes: 335
+- Coverage fraction: 0.053672
 - Closed-domain probes: 19
 - Grammar probes: 94
 
@@ -267,6 +267,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `stale_observed_signature` | `stale_observed_signature` | uncovered | none | 0 |
 | `status_duplicate` | `status_duplicate` | uncovered | none | 0 |
 | `status_invalid` | `status_invalid` | uncovered | none | 0 |
+| `status_lifecycle_role_required` | `status_lifecycle_role_required` | uncovered | none | 0 |
 | `stdin_json_invalid` | `stdin_json_invalid` | uncovered | none | 0 |
 | `stdin_json_unknown_key` | `stdin_json_unknown_key` | uncovered | none | 0 |
 | `structured_event_immutable` | `structured_event_immutable` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.29"
+    "version": "2026.8.31"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.29",
+      "version": "2026.8.31",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -116,13 +116,13 @@
     "test": "node scripts/run-tests.mjs test",
     "test:coverage": "node scripts/run-tests.mjs coverage",
     "test:fuzz": "node scripts/run-tests.mjs test -- tests/fuzz",
-    "lint": "pnpm lint:eslint && pnpm lint:duplicates && pnpm lint:codefactor",
+    "lint": "pnpm quality:static",
     "lint:eslint": "eslint . --max-warnings=0",
     "lint:eslint:prune": "eslint . --prune-suppressions",
     "lint:complexity:baseline": "eslint . --suppress-rule complexity --suppress-rule sonarjs/cognitive-complexity",
     "lint:duplicates": "jscpd --config .jscpd.json && jscpd --config .jscpd.source.json",
     "lint:codefactor": "pnpm quality:static",
-    "quality:static": "pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
+    "quality:static": "pnpm lint:eslint && pnpm lint:duplicates && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
     "quality:command-grammar": "pnpm build && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs",
     "quality:recovery-closure": "pnpm build && node scripts/release/refusal-closure-gate.mjs",
     "quality:token-budget": "node scripts/release/token-budget-gate.mjs",
@@ -227,7 +227,7 @@
     "esbuild": "0.28.2",
     "eslint": "^10.9.1",
     "eslint-plugin-sonarjs": "^4.2.0",
-    "eslint-plugin-unicorn": "^73.0.0",
+    "eslint-plugin-unicorn": "74.0.0",
     "fast-check": "^4.9.0",
     "greptile": "^3.4.2",
     "jscpd": "^5.0.16",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.8.29",
+  "version": "2026.8.31",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",