Preview Azure area and iteration moves with rule refusals and relation impact

.agents/pm/features/pm-ado-move-simulator.toon

@@ -0,0 +1,31 @@
+id: pm-ado-move-simulator
+title: Preview Azure area and iteration moves with rule and relation evidence
+description: "Preview an explicitly selected linked backlog with the existing project field contract, revision-bound Azure validation-only rule checks, typed refusals and direct relation scope changes. No apply or bulk update path."
+type: Feature
+status: in_progress
+priority: 2
+tags: []
+created_at: "2026-10-23T14:29:58.189Z"
+updated_at: "2026-10-23T14:47:14.976Z"
+author: codex-agent
+acceptance_criteria: Synthetic inherited permissions and custom iteration rules yield deterministic allowed/refused rows; No implicit bulk update and bounded request counts; Typed SDK and CLI JSON/TOON; non-git public tracker copy validation; unchanged npm and Bun CI release gates
+parent: pm-ado-g4v1
+comments[6]{created_at,author,text}:
+  "2026-10-23T14:29:58.189Z",codex-agent,"Overlap rechecked on current CLI 2026.10.23 and sibling pm-gantt-chart: generic lifecycle update mutates tracker metadata; Gantt capacity/deferral repair and scheduling contain no Azure area/iteration ACL or conditional process semantics. Reuse discoverProjectContract from pm-ado-field-contracts, existing revision patch builder, relation URL validation and host SDK complete tracker reads; no second metadata crawler. No duplicate move-simulator item found in context/search/open inventory."
+  "2026-10-23T14:32:39.895Z",codex-agent,"Design: reuse the shipped project contract and AdoClient bounded batch reader plus buildUpdatePatch and same-organization relationTargetId. Single type and explicit 1..50 linked IDs; up to 200 direct links, two batch reads, 56 total requests. Azure PATCH validateOnly=true with bypassRules=false evaluates conditional rules and effective permissions without persistence; previews have no apply/save flag. Relation evidence preserves links and reports classification boundaries if all allowed proposals move; unavailable neighbors remain unknown. No transitive, atomic multi-item or future-permission claim."
+  "2026-10-23T14:41:11.845Z",codex-agent,"Targeted Node coverage: 11/11 tests pass; moves.ts 100% lines, branches and functions. Maximum 50-item/200-link case uses exactly 56 requests. Non-git installed JSON/TOON commands pass with no git executable on PATH, preserving authoritative files. Public tracker copy at main 3592ce90: 29 items, 63 authoritative files unchanged; raw unlinked selection refuses at 0 requests. Synthetic Azure projection of those real identities/states/relations: 7 allowed, 6 inherited area denials, 16 custom iteration rule refusals, 8 direct links, 5 boundary changes, 34 requests per preview, 11057 JSON bytes, identical reversed-selection replay and zero remote mutations. Projection timing 62 ms; no live Azure acceptance claimed."
+  "2026-10-23T14:42:08.672Z",codex-agent,"Behavioral revert proof: changed only simulateMove so failed validateOnly responses were treated as allowed. The inherited-permission/custom-iteration regression failed (exit 1): the expected permission_denied and process_rule refusals became allowed rows. Restored the function byte-for-byte. No baseline history rewritten. Local source lint uses the repository docstring gate and diff whitespace check; there is no standalone lint script."
+  "2026-10-23T14:43:32.764Z",codex-agent,"Local verification complete: npm run typecheck; npm run build; npm run build:test; npm run docstring (12 source files, 86 documented declarations); git diff --check; pm test pm-ado-move-simulator --run --progress all passed (1 linked command, 11 tests, no skips). Public-copy validation repeated with GIT_CEILING_DIRECTORIES and identical counts/immutability (107 ms repeat; initial 62 ms). Revert proof is a failing permissions/rules assertion, restored. Full release gates delegated to existing npm/Bun CI jobs to respect host CPU saturation; thresholds unchanged."
+  "2026-10-23T14:47:11.013Z",codex-agent,"PR ready for review: https://github.com/unbraind/pm-ado/pull/42 at implementation b5112e3. CI https://github.com/unbraind/pm-ado/actions/runs/39972236061 passed all four jobs: npm release gate, Bun release gate, Node 22 and Node 26. Each full suite passed 226/226, zero skipped; both native coverage and statement-instrumented passes succeeded at unchanged 100/100/100/100 thresholds across 8 measured source files. Docstrings: 12 files / 86 declarations; production audit: zero vulnerabilities. CodeQL passed. Live Azure validation remains unclaimed; reviewer skips/limits are missing review evidence. Implementation complete, item remains in_progress for orchestrator verification; releasing claim without closing. The final PM-only receipt commit will receive another exact-head CI run."
+files[5]{path,scope}:
+  index.ts,project
+  moves.ts,project
+  test/fixtures/move-service.ts,project
+  test/moves.test.ts,project
+  test/real-data-moves.ts,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  node --test test/moves.test.ts,project,codex-agent,"2026-10-23T14:37:54.495Z",local_mutation,feat/move-simulator
+docs[2]{path,scope}:
+  docs/move-simulator.md,project
+  README.md,project
+body: ""

README.md

@@ -119,10 +119,21 @@ failures return typed codes plus remedies. SDK schema/tracker read failures use
 are successful diagnostic results; inspect `compatible` before planning.
 See the [SDK and CLI example](docs/field-contracts.md).
 
+## Preview area and iteration moves
+
+`pm ado move-preview --project Example --items example-a,example-b --iteration-path 'Example\Release' --json`
+validates an explicit linked backlog through the existing field contract and
+Azure revision-checked `validateOnly` requests. Rows report allowed/refused
+decisions with remedies for inherited permission denials and conditional rules.
+Direct relation boundaries show downstream classification scope; links remain
+preserved. No apply option is exposed. Limits are 50 items, 200 direct links and
+56 requests; JSON and TOON output omit item bodies and remote error messages.
+See the [SDK/CLI example and limits](docs/move-simulator.md).
+
 ## Without git
 
 `ado validate`, `ado contract`, `ado import`, `ado export`, `ado sync`,
-`ado resolve-plan` and `ado resolve-apply` work in
+`ado move-preview`, `ado resolve-plan` and `ado resolve-apply` work in
 plain trackers without git. Network operations still need Azure configuration;
 contract discovery requires an explicit project. Package release/changelog and
 GitHub workflows need a git checkout and are separate from tracker operations.

dist/index.d.ts

@@ -1,4 +1,6 @@
 import type { ExtensionApi, PreflightOverrideContext } from "@unbrained/pm-cli/sdk/authoring";
+export { simulateMove, MoveRefusal, MOVE_LIMITS } from "./moves.ts";
+export type { MoveOptions, MoveScope, MoveRow, MoveRelation, MovePreview, MoveRefusalCode } from "./moves.ts";
 export { AdoResolutionService, ResolutionRefusal, resolutionDigest, resolutionScopeReference, resolutionFields, validateResolutionPlan } from "./resolution.ts";
 export type { ResolutionPlan, ResolutionObserver, ResolutionIntent, ResolutionField, ResolutionChoice, ResolutionReceipt, ResolutionRefusalCode, ResolutionMaps } from "./resolution.ts";
 export { discoverProjectContract, ContractRefusal } from "./contracts.ts";