@unbrained/pm-cli 2026.9.25 → 2026.9.27

package/docs/CLI_GRAMMAR.md

@@ -192,3 +192,34 @@ command migration.
 Full discovery uses a uniform destination table. Its `reason` column contains
 the rationale for exceptions and an empty string where no exception applies,
 so adding a rationale does not expand every row into repeated field names.
+
+## Workspace customization and optional authoring
+
+Tracked by [pm-npr3](../.agents/pm/tasks/pm-npr3.toon) and
+[pm-uk9dwh](../.agents/pm/tasks/pm-uk9dwh.toon).
+
+| Canonical command | Compatibility spelling | Responsibility |
+| --- | --- | --- |
+| `workspace init` | `init` | Bootstrap storage, settings, and optional guidance |
+| `workspace config` | `config` | Read or change individual project/global settings |
+| `workspace schema` | `schema` | Define types, statuses, fields, and validation contracts |
+| `workspace profile` | `profile` | Apply reusable bundles of schema, settings, and templates |
+
+These facets share workspace ownership. Schema defines what records mean;
+configuration sets operating policy; profiles compose those primitives for a
+domain; initialization creates their storage. The original SDK methods and MCP
+actions keep their names and semantics. Root spellings remain permanent silent
+aliases, including their arguments and flags.
+
+`templates` remains owned by the optional templates package, within the workspace
+authoring family. Its list/save/show operations provide reusable creation defaults;
+they do not define schema or replace profiles. The destination census declares
+these optional paths even when the package is inactive. `guide` remains owned by
+`guide-shell` within the help family, so reading documentation is not a prerequisite
+for core operation. `workspace position` and `workspace snapshot` retain their
+existing state and recovery roles.
+
+The bounded orientation sequence remains `pm context --for orient`, followed by
+`pm contracts --command "workspace schema" --flags-only` (or the relevant command).
+Use `pm workspace --help` to discover customization facets. No additional core noun
+or mandatory package is introduced.

package/docs/CODEX_PLUGIN.md

@@ -7,6 +7,14 @@ MCP server. Its cached runtime installs the exact version declared by the plugin
 audit, verified gaps, and phased remediation plan are documented in
 [Native ChatGPT and Codex Plugin Implementation Plan](CHATGPT_CODEX_PLUGIN_IMPLEMENTATION.md).
 
+The portable package uses root `plugin.json` and `mcp.json`. The existing
+`.codex-plugin/plugin.json` and `.mcp.json` remain compatibility manifests for
+older hosts. The portable MCP entry launches the same exact-version cached
+server as the compatibility entry. `pnpm version:check` and the release
+provenance gate cover both versioned plugin manifests. The five portable skills
+are generated from `templates/agent-skills/` into both plugin bundles, with
+static drift checking before release.
+
 ## Install From This Repo
 
 ```bash

package/docs/EXTENSION_LIFECYCLE.md

@@ -3,6 +3,24 @@
 Tracked by [pm-ig5cfe](../.agents/pm/issues/pm-ig5cfe.toon),
 [pm-495lkc](../.agents/pm/issues/pm-495lkc.toon), and
 [pm-miy5k6](../.agents/pm/issues/pm-miy5k6.toon).
+Static inventory is tracked by [pm-lhhnx9](../.agents/pm/issues/pm-lhhnx9.toon).
+
+## Read-only configured inventory
+
+Use `pm package inventory --project --json` (or `--global`) for a host GET route
+or agent read. Pass a name to receive an explicit `absent` row. The public SDK
+equivalent is `inspectStaticExtensionInventory({ pmRoot, scope, name })` from
+`@unbrained/pm-cli/sdk`. Both read settings, managed metadata, and manifests
+without importing package entrypoints, running hooks, checking for updates,
+adopting installs, or writing workspace files. An absent managed-state file is
+reported separately from an invalid one. `complete: false` and `errors` mean
+the list must not be treated as authoritative; the CLI also exits nonzero.
+
+`configured_enabled` is the effective saved enablement setting, while
+`runtime_active` is always `null`. The static read does not prove that a package
+will activate successfully. `pm package explore`, `manage`, `doctor`, and
+`describe` probe runtime state and may execute installed package code. Run
+those commands only when an activation probe is intended.
 
 ## Explicit Install-Source Identity
 

package/docs/README.md

@@ -38,6 +38,7 @@ pm guide release --json
 - [Context and Operations Namespaces](COMMAND_NAMESPACES.md) - native navigation, diagnostics, event streams, and compatibility aliases.
 - [CLI Scripting Contract](SCRIPTING.md) - exit codes, flat mutation receipts versus read envelopes, stdout/stderr boundaries, stable JSON fields, uniform OR filters, and shell composition recipes.
 - [Configuration](CONFIGURATION.md) - settings, storage formats, output, search, validation, and environment variables.
+- [Semantic Batching and Retrieval Quality](SEARCH_QUALITY.md) - independent request bounds, execution receipts, and per-query quality floors.
 - [Testing](TESTING.md) - sandbox-safe local tests and linked-test orchestration.
 - [Completion Portability and Bounded Replication Checks](VALIDATION_PORTABILITY.md) - literal Bash choices across versions and locales, and semantic Git diff collection.
 - [Build and Release Acceptance](BUILD_AND_RELEASE_ACCEPTANCE.md) - complete-build leases and cross-platform registry installation controls.

package/docs/RELEASING.md

@@ -76,7 +76,52 @@ pnpm version:check
 
 `.github/workflows/auto-release.yml` runs once per day and can also be dispatched manually.
 
-Policy:
+### Independent morning dispatch
+
+Tracked by [pm-9url9h](../.agents/pm/tasks/pm-9url9h.toon). An independent
+operator-managed timer can invoke `scripts/release/dispatch-daily-release.mjs`
+at **04:45 Europe/Vienna** (02:45 UTC in summer, 03:45 UTC in winter).
+The aim is completion before 06:30–07:00 local time; host availability, GitHub
+runner capacity and release gates can prevent that target. The host must be
+awake, online and able to authenticate with `gh` unattended.
+
+The existing **02:35 UTC GitHub cron remains enabled as a fallback**. Either
+clock can arrive first. The dispatcher checks both release workflows for active
+runs and skips an existing exact UTC-day tag. Tag existence is explicitly not
+publication proof: incomplete publication still requires the normal immutable-tag
+recovery procedure. Hosted concurrency and the one-release-per-UTC-day guard
+remain the final protection if a native run races the external request.
+
+The standalone dispatcher requires an absolute private state directory:
+
+```bash
+node scripts/release/dispatch-daily-release.mjs --state-dir /absolute/private/state --check
+```
+
+`--check` reads prerequisites without dispatching or writing state, including
+outside the morning window. Without it, the dispatcher accepts only
+04:45–05:15 Vienna time and sends `workflow_dispatch` to `auto-release.yml` on
+`main` with explicit `push=true`, `dry_run=false`, and `telemetry_mode=off`,
+matching scheduled production policy. It never builds from the operator's
+working branch, changes release secrets or bypasses hosted gates.
+
+An exclusive daily intent file is written **before** sending the request. A
+timeout can mean GitHub accepted the request, so an uncertain attempt is retained
+and never automatically resent that UTC day. Inspect hosted run history before
+any manual recovery. Pre-dispatch read failures leave no intent; a timer may
+try again within the morning window. Late persistent-timer catch-up is a no-op.
+Install a reviewed copy outside development checkouts so branch edits cannot
+silently change an unattended service.
+
+Keep dispatcher output in the service journal: `dispatch_accepted` proves only
+API acceptance. Verify the hosted run, GitHub Release and exact npm version
+separately. These runs remain `workflow_dispatch`; they do not improve or erase
+the native `schedule` denominator in [Release Reliability](RELEASE_RELIABILITY.md).
+Disable the independent timer to roll back; the original hosted schedule and
+publication path continue unchanged. Host-specific unit files and authentication
+configuration belong in private operator documentation.
+
+### Hosted release policy
 
 - release only when commits exist after the latest release tag
 - ignore tracker-governance-only commits for publish eligibility: `.agents/pm/**` and the mechanically generated `CHANGELOG.md` projection do not create a package release by themselves, while any product, test, documentation, workflow, or other changed path remains release-relevant
@@ -282,7 +327,11 @@ The automatic release commit is the sole non-identical-tree derivation. The
 gate requires one parent, the canonical release subject and body, an immutable
 `v<version>` tag resolving to the candidate, the complete expected manifest
 inventory, exact old-version to new-version substitutions in every manifest,
-and an exact `Unreleased` changelog-heading replacement. The package-generated
+and an exact `Unreleased` changelog-heading replacement. Fixed distribution
+paths come from the same inventory as version synchronization and staging.
+Plugin runtime package manifests are mandatory when present in the immutable
+parent tree; historical parents that predate those files remain verifiable.
+The package-generated
 replacement may be `## <version>` or the historical
 `## <version> - <YYYY-MM-DD>` form, with the date matching the calendar version.
 The complete heading must match and every other changelog byte must remain

package/docs/SEARCH_QUALITY.md

@@ -0,0 +1,116 @@
+# Semantic Batching and Retrieval Quality
+
+Tracked by [pm-vjgqj5](../.agents/pm/issues/pm-vjgqj5.toon) and
+[pm-p1g43q](../.agents/pm/features/pm-p1g43q.toon).
+
+## Agent Quick Context
+
+Use `pm reindex --mode semantic --progress` to refresh stale embeddings and
+`pm eval --queries ./queries.json --k 10` to measure retrieval. A successful
+index refresh proves that vectors were written, not that relevant items rank
+well. Evaluate quality separately.
+
+## Independent Input and Request Limits
+
+The built-in scheduler preserves `search.embedding_batch_size` as the maximum
+number of input positions per planned batch. Per-input text truncation still
+uses `search.embedding_corpus_max_characters` or the provider default.
+
+Requests additionally have a 256 KiB encoded JSON byte ceiling. This counts
+UTF-8, JSON escaping, array separators, and model metadata; it is independent of
+the per-input character limit. OpenAI's single-string encoding and duplicate
+input elimination can make the actual payload smaller than this conservative
+planning bound. An individual input that cannot fit is refused before any
+request is sent. Empty inputs are also refused rather than silently shifting
+vector positions.
+
+SDK hosts may supply `maxRequestBytes` to
+`executeEmbeddingBatchesWithRetry`, exported by
+`@unbrained/pm-cli/sdk/query`. The request ceiling is a transport
+bound, not a model tokenizer or context-window claim. Model input limits remain
+provider-owned. [Ollama's embedding API](https://docs.ollama.com/api/embed)
+accepts arrays of inputs and describes its own context truncation behavior.
+
+HTTP 413 and timeout failures split a multi-input batch in half. Both halves
+complete in source order. Other failures use the configured bounded retry
+policy. A singleton failure terminates the operation; failed execution never
+returns a partial vector array. Sequential execution avoids creating a burst
+of concurrent requests against a local embedding model.
+
+HTTP status takes precedence over response text: a non-413 error containing
+the word "timeout" does not trigger splitting. For a planned batch of `n`
+positions, binary subdivision creates at most `2n - 1` request nodes, each
+with at most `scanner_max_batch_retries + 1` attempts. SDK hosts accepting
+untrusted workloads should constrain corpus size, retry settings and the
+caller-supplied byte ceiling to their provider budget; this primitive does not
+impose a universal account-level quota.
+
+`pm reindex` exposes `semantic.batching` for built-in providers:
+
+- `planned_batches` counts batches before adaptation;
+- `requests`, `successful_batches`, `split_batches`, and `retries` describe
+  actual execution;
+- `batch_size_histogram` counts successful requests by input positions;
+- `elapsed_ms` and `inputs_per_second` include retry backoff;
+- `provider`, `model`, `max_request_bytes`, and `limit_source` explain the run.
+
+These receipts contain no input text, credentials, or endpoint addresses.
+Empty work retains the existing empty result; extension providers do not
+receive a fabricated built-in batching receipt.
+
+## Per-query Quality Floors
+
+A golden query may declare a `minimum` object containing any of `ndcg`, `mrr`,
+`precision`, and `recall`. Each value must be a finite number in `[0, 1]`.
+Unknown metric names fail validation so a spelling error cannot remove a gate.
+
+```json
+[
+  {
+    "query": "snapshot restore durability",
+    "relevant_ids": ["pm-snapshot", "pm-restore"],
+    "mode": "keyword",
+    "minimum": { "recall": 0.5, "mrr": 0.5 }
+  }
+]
+```
+
+Replace the example IDs with judgments from your workspace. `pm eval` compares
+unrounded scores to these floors and reports `violations` on the affected query.
+It exits nonzero if any floor fails, even when no `--fail-under` is supplied or
+the aggregate nDCG passes. Existing query sets without floors retain their
+aggregate-only behavior. The public query SDK exports `parseEvalMetricFloors`
+and `evaluateMetricFloors` for package-owned evaluations.
+
+The repository's `quality:retrieval-eval` gate also pins floors by query text
+and retrieval mode. Missing, unexpected or duplicated identities and mismatched
+declared row counts fail. Explicit
+`--update` refreshes never lower a prior floor or discard a missing required
+query. A baseline update is a reviewed policy change; it is not permission to
+change relevance judgments until a score turns green.
+
+## Verification Boundaries
+
+Real loopback HTTP tests exercise batching, Unicode payloads, 413 recovery,
+vector ordering, and pre-dispatch refusal. Evaluator tests exercise the case
+where the macro average passes while one query fails. These are transport and
+quality-contract proofs, not measured million-item model throughput, semantic
+ranking improvements, parallel scheduling, or durable partial-run resume.
+Those broader acceptance criteria remain tracked by the linked items.
+
+## Portable Delivery Evidence
+
+Workspace-owned custom types used by delivery records must be declared in the
+tracked project schema. An ignored local extension installation does not make
+its types available to a fresh CI checkout. This repository declares `Changeset`
+in `schema/types.json` through `pm schema add-type`, and verifies changelog output
+in a clean checkout with only the published changelog package installed.
+
+Schema `--dry-run` applies to rename/remap migrations and workflow-policy
+actions. Other schema operations refuse the flag before writing, through the
+shared SDK guard used by CLI and SDK/MCP dispatch. For example,
+`pm schema rename-type Spike --to Experiment --dry-run` previews a migration;
+`pm schema add-type Spike --dry-run` is refused. Adding a type is an explicit
+write operation. Tracked by [pm-s74dca](../.agents/pm/issues/pm-s74dca.toon).
+SDK hosts can reuse `assertSchemaPreviewSupported(subcommand, dryRun)` from
+`@unbrained/pm-cli/sdk` when dispatching built-in schema operations.

package/docs/agent-task-token-baseline.json

@@ -77,7 +77,7 @@
       {
         "task_id": "orientation-contracts-next",
         "command_count": 2,
-        "estimated_tokens": 5180,
+        "estimated_tokens": 5203,
         "capabilities": [
           "actionable_work",
           "active_ownership",
@@ -120,11 +120,11 @@
     },
     {
       "id": "orientation-contracts-next",
-      "max_estimated_tokens": 5180,
+      "max_estimated_tokens": 5203,
       "steps": [
         {
           "id": "contracts",
-          "max_estimated_tokens": 4458,
+          "max_estimated_tokens": 4481,
           "accounting_mode": "self_reported"
         },
         {
@@ -261,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 13011
+  "composite_max_estimated_tokens": 13034
 }

package/docs/generated/AGENT_CAPABILITY_ROUTING.md

@@ -6,7 +6,7 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 
 | Capability family | Commands |
 | --- | --- |
-| workspace | `init`, `config`, `workspace merge`, `schema`, `profile`, `ops telemetry`, `ops health`, `ops gc`, `workspace` |
+| workspace | `workspace init`, `workspace config`, `workspace merge`, `workspace schema`, `workspace profile`, `ops telemetry`, `ops health`, `ops gc`, `workspace` |
 | intake | `create`, `item`, `item copy`, `context focus`, `history restore` |
 | context | `list`, `aggregate`, `context`, `get`, `search`, `item duplicates`, `ops eval`, `context next`, `history activity`, `ops stats`, `help` |
 | lifecycle | `update`, `update many`, `close`, `close many`, `close delete`, `claim`, `release` |

package/docs/generated/AGENT_COMMAND_SURFACE.md

@@ -5,7 +5,9 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | Command | Minimum visibility tier | Capability family |
 | --- | --- | --- |
 | `init` | core | workspace |
+| `workspace init` | core | workspace |
 | `config` | standard | workspace |
+| `workspace config` | standard | workspace |
 | `extension` | full | extensions |
 | `package` | full | extensions |
 | `packages` | full | extensions |
@@ -54,7 +56,9 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `merge` | full | workspace |
 | `workspace merge` | full | workspace |
 | `schema` | standard | workspace |
+| `workspace schema` | standard | workspace |
 | `profile` | standard | workspace |
+| `workspace profile` | standard | workspace |
 | `activity` | full | context |
 | `history activity` | full | context |
 | `restore` | full | intake |
@@ -97,7 +101,7 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `assurance` | full | quality |
 | `gc` | full | workspace |
 | `ops gc` | full | workspace |
-| `workspace` | full | workspace |
+| `workspace` | core | workspace |
 | `contracts` | standard | quality |
 | `claim` | core | lifecycle |
 | `release` | core | lifecycle |

package/docs/generated/FLAG_LEXICON_BUDGETS.md

@@ -95,6 +95,10 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `update many` | lifecycle | 146 | 146 |
 | `close many` | lifecycle | 72 | 72 |
 | `close delete` | lifecycle | 24 | 24 |
+| `workspace init` | workspace | 30 | 30 |
+| `workspace config` | workspace | 36 | 36 |
+| `workspace schema` | workspace | 43 | 43 |
+| `workspace profile` | workspace | 22 | 22 |
 | `item comments` | evidence | 31 | 31 |
 | `item notes` | evidence | 35 | 35 |
 | `item learnings` | evidence | 31 | 31 |

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,14 +4,14 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 378
+- Catalog error codes: 385
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 359
-- Coverage fraction: 0.050265
+- Uncovered error codes: 366
+- Coverage fraction: 0.049351
 - Closed-domain probes: 19
-- Grammar probes: 113
+- Grammar probes: 117
 
 | Error code | Canonical code | Disposition | Evidence kinds | Probe count |
 | --- | --- | --- | --- | --- |
@@ -96,6 +96,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `extension_mutation_guard_invalid_denial` | `extension_mutation_guard_invalid_denial` | uncovered | none | 0 |
 | `extension_mutation_guard_timed_out` | `extension_mutation_guard_timed_out` | uncovered | none | 0 |
 | `extension_update_health_partial_coverage` | `extension_update_health_partial_coverage` | uncovered | none | 0 |
+| `extensions_unreadable` | `extensions_unreadable` | uncovered | none | 0 |
 | `field_duplicate` | `field_duplicate` | uncovered | none | 0 |
 | `field_invalid` | `field_invalid` | uncovered | none | 0 |
 | `field_mcp_input_collision` | `field_mcp_input_collision` | uncovered | none | 0 |
@@ -189,8 +190,12 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `locks_stale_count` | `locks_stale_count` | uncovered | none | 0 |
 | `locks_unreadable` | `locks_unreadable` | uncovered | none | 0 |
 | `malformed_plan_step_evidence` | `malformed_plan_step_evidence` | uncovered | none | 0 |
+| `managed_state_invalid` | `managed_state_invalid` | uncovered | none | 0 |
+| `managed_state_unreadable` | `managed_state_unreadable` | uncovered | none | 0 |
 | `manifest_capabilities_absent` | `manifest_capabilities_absent` | uncovered | none | 0 |
+| `manifest_invalid` | `manifest_invalid` | uncovered | none | 0 |
 | `manifest_unknown_key` | `manifest_unknown_key` | executable | owned_state | 1 |
+| `manifest_unreadable` | `manifest_unreadable` | uncovered | none | 0 |
 | `mcp_annotation_file_unavailable` | `mcp_annotation_file_unavailable` | uncovered | none | 0 |
 | `mcp_stdin_unavailable` | `mcp_stdin_unavailable` | uncovered | none | 0 |
 | `mcp_task_not_found_or_not_authorized` | `mcp_task_not_found_or_not_authorized` | uncovered | none | 0 |
@@ -216,7 +221,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `missing_parameter_alias` | `missing_parameter_alias` | uncovered | none | 0 |
 | `missing_positive_execution_receipt` | `missing_positive_execution_receipt` | uncovered | none | 0 |
 | `missing_probe` | `missing_probe` | uncovered | none | 0 |
-| `missing_required_argument` | `missing_required_argument` | executable | grammar | 75 |
+| `missing_required_argument` | `missing_required_argument` | executable | grammar | 77 |
 | `missing_required_option` | `missing_required_option` | uncovered | none | 0 |
 | `missing_suggested_retry` | `missing_suggested_retry` | uncovered | none | 0 |
 | `missing_suggested_retry_args` | `missing_suggested_retry_args` | uncovered | none | 0 |
@@ -274,10 +279,12 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `retry_failed` | `retry_failed` | uncovered | none | 0 |
 | `schema_migration_input_required` | `schema_migration_input_required` | uncovered | none | 0 |
 | `semantic_spelling_collision` | `semantic_spelling_collision` | uncovered | none | 0 |
+| `settings_invalid` | `settings_invalid` | uncovered | none | 0 |
 | `settings_read_fs_error` | `settings_read_fs_error` | uncovered | none | 0 |
 | `settings_read_invalid_json` | `settings_read_invalid_json` | uncovered | none | 0 |
 | `settings_read_invalid_schema` | `settings_read_invalid_schema` | uncovered | none | 0 |
 | `settings_read_merge_failed` | `settings_read_merge_failed` | uncovered | none | 0 |
+| `settings_unreadable` | `settings_unreadable` | uncovered | none | 0 |
 | `stale_budget` | `stale_budget` | uncovered | none | 0 |
 | `stale_destination` | `stale_destination` | uncovered | none | 0 |
 | `stale_observed_signature` | `stale_observed_signature` | uncovered | none | 0 |
@@ -318,13 +325,13 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `unknown_field` | `unknown_field` | uncovered | none | 0 |
 | `unknown_field_projection` | `unknown_field_projection` | executable | closed_domain | 10 |
 | `unknown_item_type` | `unknown_item_type` | uncovered | none | 0 |
-| `unknown_lifecycle_action` | `unknown_subcommand` | executable | grammar, owned_state | 12 |
+| `unknown_lifecycle_action` | `unknown_subcommand` | executable | grammar, owned_state | 14 |
 | `unknown_noun` | `unknown_noun` | uncovered | none | 0 |
 | `unknown_option` | `unknown_option` | executable | owned_state | 1 |
 | `unknown_plan_template` | `unknown_plan_template` | uncovered | none | 0 |
 | `unknown_provenance_dimension` | `unknown_provenance_dimension` | uncovered | none | 0 |
 | `unknown_status` | `unknown_status` | uncovered | none | 0 |
-| `unknown_subcommand` | `unknown_subcommand` | executable | grammar, owned_state | 12 |
+| `unknown_subcommand` | `unknown_subcommand` | executable | grammar, owned_state | 14 |
 | `unsafe_init_recovery` | `unsafe_init_recovery` | uncovered | none | 0 |
 | `unsupported_update_option` | `unsupported_update_option` | uncovered | none | 0 |
 | `validate_command_references_stale_pm_ids` | `validate_command_references_stale_pm_ids` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.25"
+    "version": "2026.9.27"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.25",
+      "version": "2026.9.27",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -123,7 +123,7 @@
     "lint:complexity:baseline": "eslint . --suppress-rule complexity --suppress-rule sonarjs/cognitive-complexity",
     "lint:duplicates": "jscpd --config .jscpd.json && jscpd --config .jscpd.source.json && jscpd --config .jscpd.tables.json",
     "lint:codefactor": "pnpm quality:static",
-    "quality:static": "pnpm quality:docstrings && pnpm quality:exports && pnpm lint:eslint && pnpm lint:duplicates && node scripts/check-workflow-permissions.mjs && node scripts/check-dependency-cooldown.mjs && node scripts/gen-plugin-mcp-wrappers.mjs --check && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded && pnpm quality:mutation -- --prebuilt",
+    "quality:static": "pnpm quality:docstrings && pnpm quality:exports && pnpm lint:eslint && pnpm lint:duplicates && node scripts/check-workflow-permissions.mjs && node scripts/check-dependency-cooldown.mjs && node scripts/gen-plugin-mcp-wrappers.mjs --check && node scripts/gen-agent-plugin-skills.mjs --check && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded && pnpm quality:mutation -- --prebuilt",
     "quality:exports": "knip --no-config-hints && node scripts/run-tests.mjs test -- tests/unit/scripts/release/dead-exports.spec.ts",
     "quality:command-grammar": "pnpm build && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs",
     "quality:recovery-closure": "pnpm build && node scripts/release/refusal-closure-gate.mjs",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-claude/README.md

@@ -13,6 +13,10 @@ Native pm CLI integration for Claude Code. Use pm project management tools direc
 | **Hybrid TUI tracking** | pm items sync to Claude Code's task panel — pm is the persistent store, the task panel is the live session view |
 | **Session hook** | Injects active pm item summary at session start using the same pinned pm-cli runtime as the MCP server |
 
+The five skills are generated from the shared portable source in
+`templates/agent-skills/`. Both plugin packages carry identical workflow
+guidance; the Claude task panel mapping is conditional on its tools.
+
 ## Installation
 
 ### Option A: Plugin marketplace — canonical install (recommended)
@@ -177,7 +181,7 @@ Spawn pm-triage-agent to set up the pm item for: add OAuth2 login support
 
 ## Hybrid TUI Sync Pattern
 
-All skills and commands implement this pattern for every claimed item:
+Claude commands can mirror claimed items with this pattern:
 
 ```
 1. pm_claim → [pm stores claim]

package/plugins/pm-claude/package.json

@@ -2,8 +2,8 @@
   "name": "pm-claude-runtime",
   "private": true,
   "type": "module",
-  "version": "2026.9.25",
+  "version": "2026.9.27",
   "dependencies": {
-    "@unbrained/pm-cli": "2026.9.25"
+    "@unbrained/pm-cli": "2026.9.27"
   }
 }