@unbrained/pm-cli 2026.8.30 → 2026.9.1

package/docs/TESTING.md

@@ -8,10 +8,11 @@ Tracked implementation updates: [pm-52eh](../.agents/pm/features/pm-52eh.toon),
 
 - Unit and integration tests must not read or write real `.agents/pm` data.
 - Prefer `node scripts/run-tests.mjs ...` because it creates sandboxed `PM_PATH` and `PM_GLOBAL_PATH`.
-- Linked tests added through `pm test` should use sandbox-safe commands.
-  Package-manager scripts such as `pnpm test` are allowed because linked-test
-  execution injects isolated `PM_PATH` and `PM_GLOBAL_PATH`; direct runners such
-  as `vitest` still need `node scripts/run-tests.mjs ...` or inline sandbox env.
+- Linked-test execution injects isolated `PM_PATH` and `PM_GLOBAL_PATH` for
+  every command and applies stored-command provenance checks before process
+  creation. Direct runners are accepted; prefer
+  `node scripts/run-tests.mjs ...` when the repository provides it because the
+  wrapper also reproduces build, coverage, and cleanup policy.
 - Run linked tests before closing the item that owns the work.
 
 Tracked documentation work: [pm-u9d0](../.agents/pm/epics/pm-u9d0.toon).
@@ -62,7 +63,8 @@ and stable error-code drift across the aggregate and every narrow SDK
 entrypoint. The performance gates protect entrypoint import cost and one-item
 CLI cold-start overhead without touching the repository tracker.
 
-`pnpm lint` is the local CodeFactor parity check. It layers ESLint rules for
+`pnpm lint` and `pnpm quality:static` are the same canonical local static gate.
+The gate layers ESLint rules for
 shipped source, package, plugin, and script surfaces that match the CodeFactor
 maintainability findings this repo tracks (`complexity`,
 `no-unsafe-optional-chaining`, and the relevant `eslint-plugin-unicorn`
@@ -193,7 +195,7 @@ Fixture source:
 Local run:
 
 ```bash
-pm install search-advanced --project
+pm package install search-advanced --project
 pm reindex --mode keyword --eval --eval-fixtures tests/search-eval/golden-queries.json --json
 ```
 
@@ -385,12 +387,12 @@ correction; executable retry argv is never collection-truncated. The
 missing-probe negative control and the authoritative tracker-state snapshot
 prove that the corpus cannot silently shrink or turn a refusal into a mutation.
 
-The gate derives every supported harness, model, session, and provenance
-environment key from the SDK-owned harness descriptor registry. It deletes
-those host inputs before each fixture invocation, then supplies only the
-fixture's deterministic author and isolated tracker settings. Unrelated host
-environment values remain available, so the test process stays representative
-without allowing the launching agent or CI harness to change measured output.
+The gate starts every fixture command from a closed environment allowlist. It
+retains only declared process-portability inputs such as `PATH`, temporary and
+home roots, and Windows process-launch variables, then supplies fixed locale,
+timezone, author, telemetry, and isolated tracker settings. Undeclared host
+values cannot reach measured output, including future harness variables that
+the descriptor registry does not yet know about.
 
 ## Linked Tests
 
@@ -493,6 +495,13 @@ trusted legacy command.
 These pre-execution refusals use the `trust_refusal` failure category, separate
 from command or assertion failures.
 
+Command-string shape is intentionally not treated as a security boundary.
+Direct `node --test`, Vitest, package-manager, shell-wrapped, and non-Node
+runners are accepted consistently because the runtime injects tracker
+isolation for all of them. `classifyLinkedTestCommandSafety` exposes the same
+SDK policy to package hosts and returns advisory runner classification;
+provenance review and acknowledgment remain the execution trust boundary.
+
 Choose one explicit recovery:
 
 ```bash
@@ -577,7 +586,7 @@ Linked tests can include assertion metadata:
 
 ```bash
 pm test <item-id> --add \
-  command="pm list-open --json",timeout_seconds=120,assert_json_field_gte=count:0
+  command="pm list --status open --json",timeout_seconds=120,assert_json_field_gte=count:0
 ```
 
 Common assertion keys include:
@@ -614,7 +623,7 @@ exemplar for background run management. Install it in an isolated project when
 validating package-provided test-run surfaces:
 
 ```bash
-pm install linked-test-adapters --project
+pm package install linked-test-adapters --project
 pm package doctor --project --detail deep --trace
 pm test-runs list --json
 ```

package/docs/WORKSPACE_POSITION_AND_LIFECYCLE.md

@@ -0,0 +1,113 @@
+# Workspace Position and Lifecycle Roles
+
+Tracker references: [pm-bq0ii8](../.agents/pm/features/pm-bq0ii8.toon), [pm-0mhspz](../.agents/pm/issues/pm-0mhspz.toon)
+
+## Agent Quick Context
+
+Project management is context management. A project status must therefore be both semantically classifiable and operationally safe to merge. Two SDK-owned primitives provide that baseline:
+
+- lifecycle roles make custom workflow states participate consistently in `next`, `context`, list aliases, validation, and health;
+- workspace position combines merge-fence, pending merge-receipt, and append-only history evidence into one bounded readiness state and one next action.
+
+## Role-Safe Custom Statuses
+
+Every newly registered custom status requires at least one lifecycle role:
+
+```bash
+pm schema add-status review --role active
+pm schema add-status waiting_external --role blocked
+pm schema add-status abandoned --role terminal --role terminal_canceled
+```
+
+The supported roles are `draft`, `active`, `blocked`, `terminal`, `terminal_done`, `terminal_canceled`, `default_open`, `default_close`, and `default_cancel`. A status may have multiple roles when it is both a lifecycle member and a workflow default.
+
+An existing status can be updated without repeating `--role`; its registered role is preserved. New roleless statuses and explicit empty role lists are refused. This prevents an item from being accepted into storage but disappearing from every actionable read.
+
+Role-derived behavior is shared:
+
+- `pm next` treats every `active` status as actionable unless dependency or blocker rules exclude it.
+- `pm list --status open` and the deprecated `pm list-open` alias include active statuses other than the configured `in_progress_status`.
+- `pm list --status in_progress` and `pm list-in-progress` select the configured in-progress workflow anchor.
+- `pm context` guarantees `summary.active_items = summary.open + summary.in_progress`; custom active statuses cannot disappear from that accounting.
+- `pm list-blocked` continues to combine blocked-role status and unresolved dependency evidence.
+
+Legacy hand-edited or older trackers may still contain roleless definitions. Both commands surface the same warning and bounded affected-item evidence:
+
+```bash
+pm health --check-only --full --json
+pm validate --check-lifecycle --json
+```
+
+Look for `schema_status_missing_lifecycle_role:<count>` and
+`lifecycle_status_roles`. Diagnostics retain `roleless_status_count` while
+bounding both status and affected-item ID samples with explicit truncation
+flags. Repair the schema by re-registering each status with its intended role
+before making workflow decisions.
+
+## One Workspace Position Read
+
+Run:
+
+```bash
+pm workspace position
+pm workspace position --json
+```
+
+The read requires no feature flag or session state. It reports:
+
+- whether the committed `.gitattributes` merge fence matches the project schema;
+- whether this clone has all required field-aware Git driver definitions;
+- pending merge decisions, lossless receipt count, and invalid evidence count;
+- bounded append-only history-drift counts and affected item IDs;
+- one deterministic `state` and one `next_action.command`.
+
+The next action always pins the inspected tracker with `--pm-path` and uses the
+SDK's platform-aware command renderer. Paths with spaces or shell-significant
+characters are therefore copy-safe on both POSIX shells and Windows command
+lines, while package consumers can reuse `renderPmCommand` for their own
+tokenized recovery actions.
+
+Recovery precedence is intentional:
+
+| State                           | Next action                                | Why it comes first                                                        |
+| ------------------------------- | ------------------------------------------ | ------------------------------------------------------------------------- |
+| `merge_evidence_invalid`        | `pm merge report`                          | Untrusted evidence must be inspected before it can drive repair.          |
+| `history_evidence_invalid`      | `pm validate --check-history-drift --full` | Required history evidence could not be interpreted safely.                |
+| `merge_reconciliation_required` | `pm merge reconcile`                       | Pending scalar decisions can explain and settle merge-created divergence. |
+| `history_repair_required`       | `pm history-repair --all`                  | Remaining append-only drift needs an audited re-anchor.                   |
+| `merge_fence_unprepared`        | `pm merge install`                         | The committed fence or clone-local drivers are absent or drifted.         |
+| `ready`                         | none                                       | All included readiness predicates passed.                                 |
+
+`pm health --strict-exit` also treats missing clone-local merge drivers as blocking. Default health remains advisory for never-installed drivers so ordinary diagnostics retain backward compatibility.
+
+## SDK and Generic Runtime
+
+Package authors can use the same implementation as the CLI:
+
+```ts
+import {
+  inspectStatusRoleAssignments,
+  readWorkspacePosition,
+  resolveRuntimeStatusRegistry,
+} from "@unbrained/pm-cli/sdk";
+
+const position = await readWorkspacePosition({ path: ".agents/pm" });
+if (!position.ok) {
+  console.log(position.next_action.command);
+}
+```
+
+The generic SDK/MCP action is `workspace` with `subcommand: "position"`. Snapshot operations remain `subcommand: "snapshot"` plus `snapshotAction`. Presentation layers do not duplicate readiness or lifecycle classification logic.
+
+## Operational Sequence
+
+On a fresh clone:
+
+```bash
+npm install -g .
+pm merge install
+pm workspace position --json
+pm health --strict-exit --full --json
+```
+
+After a branch merge, run workspace position before claiming that the tracker is safe. Follow only its selected next action, rerun the read, and continue until `state` is `ready`. This keeps remediation evidence ordered, token-bounded, and reproducible.

package/docs/agent-task-token-baseline.json

@@ -1,11 +1,165 @@
 {
-  "version": 3,
+  "version": 4,
   "transcript_version": 2,
-  "transcript_digest": "sha256:2bf91406426d2a9e5de1da10ba67f7b8e9d4a4baa09eb488fe89ae3925c78f3f",
+  "transcript_digest": "sha256:4f9e96bb6ce12bbbeb2514e4bd5958d201c4e62e95083bcbebd749d1e48cc82d",
   "estimator": "ceil(utf8_bytes / 4)",
   "measurement_scope": "output_before_token_accounting",
   "published_with_release": true,
+  "orientation": {
+    "canonical_task_id": "orientation-context-intent",
+    "required_capabilities": [
+      "actionable_work",
+      "active_ownership",
+      "workspace_state"
+    ],
+    "measured_winner_tokens": 1055,
+    "protocols": [
+      {
+        "task_id": "orientation-context-intent",
+        "command_count": 1,
+        "estimated_tokens": 1055,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "context",
+              "field_path": "hierarchy"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "context",
+              "field_path": "activity"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "context",
+              "field_path": "summary.active_items"
+            }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-operating-rules",
+        "command_count": 4,
+        "estimated_tokens": 2293,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "open",
+              "field_path": "items"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "in-progress",
+              "field_path": "items"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "context",
+              "field_path": "summary.active_items"
+            }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-contracts-next",
+        "command_count": 2,
+        "estimated_tokens": 4798,
+        "capabilities": [
+          "actionable_work",
+          "active_ownership",
+          "workspace_state"
+        ],
+        "capability_evidence": {
+          "actionable_work": [
+            {
+              "step_id": "next",
+              "field_path": "recommended.id"
+            }
+          ],
+          "active_ownership": [
+            {
+              "step_id": "next",
+              "field_path": "held_by_others"
+            }
+          ],
+          "workspace_state": [
+            {
+              "step_id": "next",
+              "field_path": "summary.in_progress"
+            }
+          ]
+        }
+      }
+    ]
+  },
   "tasks": [
+    {
+      "id": "orientation-context-intent",
+      "max_estimated_tokens": 1055,
+      "steps": [
+        {
+          "id": "context",
+          "max_estimated_tokens": 1055,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
+    {
+      "id": "orientation-contracts-next",
+      "max_estimated_tokens": 4798,
+      "steps": [
+        {
+          "id": "contracts",
+          "max_estimated_tokens": 4111,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "next",
+          "max_estimated_tokens": 687,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
+    {
+      "id": "orientation-operating-rules",
+      "max_estimated_tokens": 2293,
+      "steps": [
+        {
+          "id": "context",
+          "max_estimated_tokens": 1055,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "search",
+          "max_estimated_tokens": 164,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "open",
+          "max_estimated_tokens": 878,
+          "accounting_mode": "self_reported"
+        },
+        {
+          "id": "in-progress",
+          "max_estimated_tokens": 196,
+          "accounting_mode": "self_reported"
+        }
+      ]
+    },
     {
       "id": "context-bootstrap",
       "max_estimated_tokens": 1978,
@@ -107,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 4331
+  "composite_max_estimated_tokens": 12477
 }

package/docs/agent-task-transcripts.json

@@ -1,6 +1,149 @@
 {
   "version": 2,
+  "orientation": {
+    "canonical_task_id": "orientation-context-intent",
+    "required_capabilities": [
+      "workspace_state",
+      "active_ownership",
+      "actionable_work"
+    ],
+    "protocols": [
+      {
+        "task_id": "orientation-context-intent",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "context", "field_path": "summary.active_items" }
+          ],
+          "active_ownership": [
+            { "step_id": "context", "field_path": "activity" }
+          ],
+          "actionable_work": [
+            { "step_id": "context", "field_path": "hierarchy" }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-contracts-next",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "next", "field_path": "summary.in_progress" }
+          ],
+          "active_ownership": [
+            { "step_id": "next", "field_path": "held_by_others" }
+          ],
+          "actionable_work": [
+            { "step_id": "next", "field_path": "recommended.id" }
+          ]
+        }
+      },
+      {
+        "task_id": "orientation-operating-rules",
+        "capabilities": [
+          "workspace_state",
+          "active_ownership",
+          "actionable_work"
+        ],
+        "capability_evidence": {
+          "workspace_state": [
+            { "step_id": "context", "field_path": "summary.active_items" }
+          ],
+          "active_ownership": [
+            { "step_id": "in-progress", "field_path": "items" }
+          ],
+          "actionable_work": [{ "step_id": "open", "field_path": "items" }]
+        }
+      }
+    ]
+  },
   "tasks": [
+    {
+      "id": "orientation-context-intent",
+      "description": "Build sufficient cold-start workspace, ownership, and actionable-work context with the bounded orientation intent.",
+      "steps": [
+        {
+          "id": "context",
+          "args": ["context", "--for", "orient", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["summary.active_items", "hierarchy", "activity"]
+        }
+      ]
+    },
+    {
+      "id": "orientation-contracts-next",
+      "description": "Compare the proposed contracts-summary plus next cold-start protocol on the same fixed workspace.",
+      "steps": [
+        {
+          "id": "contracts",
+          "args": ["contracts", "--summary"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["commands"]
+        },
+        {
+          "id": "next",
+          "args": ["next", "--for", "execute", "--ready-only", "--limit", "3"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": [
+            "summary.in_progress",
+            "held_by_others",
+            "recommended.id"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "orientation-operating-rules",
+      "description": "Compare the historical context, search, open-list, and in-progress-list orientation sequence.",
+      "steps": [
+        {
+          "id": "context",
+          "args": ["context", "--for", "orient", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "diagnostic",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["summary.active_items", "hierarchy", "activity"]
+        },
+        {
+          "id": "search",
+          "args": ["search", "agent task", "--status", "all", "--limit", "10"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        },
+        {
+          "id": "open",
+          "args": ["list", "--status", "open", "--limit", "20"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        },
+        {
+          "id": "in-progress",
+          "args": ["list", "--status", "in_progress", "--limit", "20"],
+          "expected_exit_code": 0,
+          "expected_output_kind": "collection",
+          "expected_accounting_mode": "self_reported",
+          "required_fields": ["items"]
+        }
+      ]
+    },
     {
       "id": "context-bootstrap",
       "description": "Orient in a scaled workspace and inspect the canonical focus item.",

package/docs/examples/policy-restricted-extension/README.md

@@ -26,7 +26,7 @@ cp -R docs/examples/policy-restricted-extension .agents/pm/extensions/policy-res
 cd .agents/pm/extensions/policy-restricted-extension
 npm install
 cd -
-pm extension --install --project .agents/pm/extensions/policy-restricted-extension
+pm package install --project .agents/pm/extensions/policy-restricted-extension
 ```
 
 Add policy in `.agents/pm/settings.json`:
@@ -68,7 +68,7 @@ Add policy in `.agents/pm/settings.json`:
 Then validate:
 
 ```bash
-pm extension --doctor --project --detail summary
+pm package doctor --project --detail summary
 pm policy demo
 ```
 

package/docs/examples/starter-extension/README.md

@@ -38,7 +38,7 @@ cd -
 
 # 3) Install/activate in project scope (package-first vocabulary;
 #    `pm extension --install` remains as a compatibility form)
-pm install .agents/pm/extensions/starter-extension --project
+pm package install .agents/pm/extensions/starter-extension --project
 
 # 4) Run a starter command
 pm starter ping --name "agent"

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 353
+- Catalog error codes: 354
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 334
-- Coverage fraction: 0.053824
+- Uncovered error codes: 335
+- Coverage fraction: 0.053672
 - Closed-domain probes: 19
 - Grammar probes: 94
 
@@ -267,6 +267,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `stale_observed_signature` | `stale_observed_signature` | uncovered | none | 0 |
 | `status_duplicate` | `status_duplicate` | uncovered | none | 0 |
 | `status_invalid` | `status_invalid` | uncovered | none | 0 |
+| `status_lifecycle_role_required` | `status_lifecycle_role_required` | uncovered | none | 0 |
 | `stdin_json_invalid` | `stdin_json_invalid` | uncovered | none | 0 |
 | `stdin_json_unknown_key` | `stdin_json_unknown_key` | uncovered | none | 0 |
 | `structured_event_immutable` | `structured_event_immutable` | uncovered | none | 0 |

package/docs/performance/cli-transport-overhead.md

@@ -7,12 +7,14 @@ admission reliability owned by
 Each result starts from a fresh isolated workspace containing exactly one item.
 The command runs in a fresh Node v26.5.0 process on
 linux/x64; setup and fixture generation are
-outside the timed interval. Short local gates use the best observed latency,
-while the report retains p50 and p95 evidence. RSS admission uses the measured
-median so one page-level outlier cannot false-fail the gate; the maximum remains
-in the report as diagnostic evidence. Every post-warmup RSS sample must be a
-finite measurement; an unavailable sample makes the admission median unavailable
-and fails closed when a budget exists. Admission adds a fixed 512 KiB noise margin
+outside the timed interval. The default gate measures ten post-warmup fresh
+processes per command and uses the best observed latency, which keeps the
+immutable ratchets meaningful under transient host contention; the report
+retains p50 and p95 evidence. RSS admission uses the measured median so one
+page-level outlier cannot false-fail the gate; the maximum remains in the report
+as diagnostic evidence. Every post-warmup RSS sample must be a finite
+measurement; an unavailable sample makes the admission median unavailable and
+fails closed when a budget exists. Admission adds a fixed 512 KiB noise margin
 without changing the committed budget; a majority persistent increase beyond
 that bounded margin still fails.
 

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.30"
+    "version": "2026.9.1"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.30",
+      "version": "2026.9.1",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.8.30",
+  "version": "2026.9.1",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -116,13 +116,13 @@
     "test": "node scripts/run-tests.mjs test",
     "test:coverage": "node scripts/run-tests.mjs coverage",
     "test:fuzz": "node scripts/run-tests.mjs test -- tests/fuzz",
-    "lint": "pnpm lint:eslint && pnpm lint:duplicates && pnpm lint:codefactor",
+    "lint": "pnpm quality:static",
     "lint:eslint": "eslint . --max-warnings=0",
     "lint:eslint:prune": "eslint . --prune-suppressions",
     "lint:complexity:baseline": "eslint . --suppress-rule complexity --suppress-rule sonarjs/cognitive-complexity",
     "lint:duplicates": "jscpd --config .jscpd.json && jscpd --config .jscpd.source.json",
     "lint:codefactor": "pnpm quality:static",
-    "quality:static": "pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
+    "quality:static": "pnpm lint:eslint && pnpm lint:duplicates && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
     "quality:command-grammar": "pnpm build && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs",
     "quality:recovery-closure": "pnpm build && node scripts/release/refusal-closure-gate.mjs",
     "quality:token-budget": "node scripts/release/token-budget-gate.mjs",
@@ -231,7 +231,7 @@
     "fast-check": "^4.9.0",
     "greptile": "^3.4.2",
     "jscpd": "^5.0.16",
-    "tsx": "^4.23.12",
+    "tsx": "^4.23.13",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.68.0",
     "vitest": "^4.1.11"

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.8.30",
+  "version": "2026.9.1",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",