@unbrained/pm-cli 2026.9.11 → 2026.9.12

package/docs/WORKFLOW_POLICIES.md

@@ -1,6 +1,6 @@
 # Declarative workflow policies
 
-Tracker: [pm-mj42og](../.agents/pm/features/pm-mj42og.toon) and [pm-htbetn](../.agents/pm/features/pm-htbetn.toon).
+Tracker: [pm-mj42og](../.agents/pm/features/pm-mj42og.toon) [pm-htbetn](../.agents/pm/features/pm-htbetn.toon), [pm-khd2fd](../.agents/pm/issues/pm-khd2fd.toon), and [pm-ycv2cz](../.agents/pm/issues/pm-ycv2cz.toon).
 
 Projects can describe their lifecycle requirements as versioned data. The SDK
 uses the same evaluator for item mutations, policy previews, and completeness
@@ -10,7 +10,7 @@ warn, or refuse; refusal also requires an explicit workspace opt-in.
 ## Configure a requirement
 
 ```bash
-pm schema policy-put close-evidence --definition '{"id":"close-evidence","effect":"refuse","subject":{"statuses":["closed"]},"rule":{"kind":"require_fields","fields":["resolution","actual_result"]}}'
+pm schema policy-put close-evidence --definition '{"effect":"refuse","subject":{"statuses":["closed"]},"rule":{"kind":"require_fields","fields":["resolution","actual_result"]}}'
 pm schema policies
 pm schema policy-check pm-example --definition '{"status":"closed"}'
 pm schema policy-mode refuse
@@ -21,6 +21,10 @@ body. Custom fields can use dotted paths with at most eight segments. Empty
 strings, arrays, objects, null, and absent values do not satisfy required fields;
 zero and false are meaningful values.
 
+`policy-put` accepts the id once: pass it as the operand, or omit the operand
+and include `id` in the definition. When both are supplied their normalized ids
+must agree; a mismatch refuses without changing the registry or history.
+The same normalization applies to JSON strings, objects, previews, SDK, and MCP.
 `policy-put` replaces a declaration with the same id. `policy-remove <id>` removes
 one declaration. `policy-mode advise` disables refusal while retaining diagnostics.
 Registry writes are locked and recorded in workspace history. `--dry-run` previews
@@ -122,8 +126,48 @@ declaration once. Later edits to the supplied document do not change that
 snapshot; create another evaluator to adopt them. Completeness validation uses
 one such snapshot for the whole supplied corpus.
 
-The schema contract version is 4.16. Existing schema operations remain available;
+The schema contract version is 4.19; `policy-put` requires `definition` but
+no longer requires a separate `name`. Existing schema operations remain available;
 `SchemaResult` now also includes `WorkflowPolicyActionResult`. Consumers that
 exhaustively narrow schema results should handle the `policy_result: true`
 discriminant. Validation options include `checkCompleteness`, and validation
 results can contain a `completeness` check.
+
+## Require a meaningful completeness contract
+
+A successful completeness check means no applicable field requirement was
+violated. It does not establish that a project declared any requirements.
+The receipt exposes these independent measurements even in counts mode:
+
+| Field | Meaning |
+| --- | --- |
+| `declared_requirement_count` | Number of `require_fields` declarations, including operation-specific ones |
+| `state_requirement_count` | Number eligible for a state scan, without operation selectors |
+| `applicable_requirement_count` | Distinct requirements that matched at least one supplied item |
+| `requirement_application_count` | Item/requirement pairs actually evaluated |
+| `governed_items`, `ungoverned_items` | Items with and without a matching state requirement |
+| `contract_status` | `undeclared`, `empty`, `inapplicable`, `partial`, or `covered` |
+
+`applied_policy_ids` is bounded by the diagnostic row limit; its truncation flag
+and `applicable_requirement_count` retain the complete total. `covered` describes
+applicability, not compliance: violations are reported independently. Unreadable
+source data still fails the check, regardless of the coverage of readable items.
+
+Projects can require a nonempty applied contract with the existing assurance
+primitives. Replace `pm-example` with the accountable item in your workspace:
+
+```bash
+pm assurance put measurement completeness-contract --definition '{"id":"completeness-contract","source":{"kind":"validate","check":"completeness","field":"applicable_requirement_count"}}'
+pm assurance put assertion completeness-contract-required --definition '{"id":"completeness-contract-required","measurement_id":"completeness-contract","owner_item_id":"pm-example","scope":{"kind":"all"},"floor":1,"lifetime":"hold","enforcement":"block","negative_control":{"cases":[{"observed":0,"expected":"fail"},{"observed":1,"expected":"pass"}]}}'
+pm assurance put gate completeness-contract --definition '{"id":"completeness-contract","assertion_ids":["completeness-contract-required"],"triggers":["ci"]}'
+pm assurance run completeness-contract --trigger ci --dry-run
+pm ops validate --check-completeness --strict-exit
+```
+
+Run both checks: the gate requires applicability and validation checks compliance.
+Deleting the last applicable policy fails the gate. For an empty workspace, or a
+contract intended only for a future lifecycle state, measure
+`state_requirement_count` instead. To require coverage of every current item,
+also enforce a zero bound on `ungoverned_items`. Higher per-project floors can
+protect against partial policy deletion; a floor of one only proves at least
+one requirement applies.

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 371
+- Catalog error codes: 374
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 352
-- Coverage fraction: 0.051213
+- Uncovered error codes: 355
+- Coverage fraction: 0.050802
 - Closed-domain probes: 19
 - Grammar probes: 101
 
@@ -169,10 +169,13 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `invalid_reproducible_process_environment` | `invalid_reproducible_process_environment` | uncovered | none | 0 |
 | `invalid_workspace_snapshot_target` | `invalid_workspace_snapshot_target` | uncovered | none | 0 |
 | `item_already_active` | `item_already_active` | uncovered | none | 0 |
+| `item_deleted` | `item_deleted` | uncovered | none | 0 |
 | `item_document_encoding_invalid` | `item_document_encoding_invalid` | uncovered | none | 0 |
 | `item_document_invalid` | `item_document_invalid` | uncovered | none | 0 |
 | `item_document_roundtrip_failed` | `item_document_roundtrip_failed` | uncovered | none | 0 |
 | `item_id_collision` | `item_id_collision` | uncovered | none | 0 |
+| `item_identity_ambiguous` | `item_identity_ambiguous` | uncovered | none | 0 |
+| `item_identity_conflict` | `item_identity_conflict` | uncovered | none | 0 |
 | `item_identity_reserved` | `item_identity_reserved` | uncovered | none | 0 |
 | `item_not_found` | `item_not_found` | uncovered | none | 0 |
 | `likely_duplicate` | `likely_duplicate` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.11"
+    "version": "2026.9.12"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.11",
+      "version": "2026.9.12",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/README.md

@@ -4,6 +4,28 @@ Trackers: [pm-fmy9ih](../../.agents/pm/tasks/pm-fmy9ih.toon), [pm-vjk3](../../.a
 
 First-party package that restores optional governance audit surfaces in bare-core `pm`.
 
+## Concurrent annotations under strict ownership
+
+Tracked by [pm-nrkjik](../../.agents/pm/issues/pm-nrkjik.toon).
+
+Merge-safe notes preserve independent entries during merging. Strict ownership
+still applies to writes. For an approved append across owners, install this
+package and use its narrow flag:
+
+```bash
+pm package install governance-audit --project
+pm notes pm-example "Review observation" --allow-audit-comment
+```
+
+The same flag works for `comments` and `learnings`. It permits additions only:
+edit and delete still require ownership, and the existing assignee is preserved.
+For a non-terminal handoff, the current owner runs `pm release <id>`, then the
+new owner runs `pm claim <id>`; claim refuses work still held by another owner.
+This changes the assignee;
+it is a different operation from appending an observation. Bare `--force` remains
+an explicit override requiring approval. Body `append` is not merge-safe and has
+no annotation bypass; use a note when the information is an independent event.
+
 ## Hooks
 
 The package also registers default-inert `onRead` and `onWrite` hooks as the

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.9.11",
+  "version": "2026.9.12",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",