unbraind · unbraind · Sep 17, 2026 · Sep 17, 2026
diff --git a/.agents/pm/chores/pm-csv-nkab.toon b/.agents/pm/chores/pm-csv-nkab.toon
@@ -0,0 +1,24 @@
+id: pm-csv-nkab
+title: Certify pm CLI 2026.9.17
+description: "CI runs the repository-pinned pm binary, so the pin decides what every gate exercises. This repository pins @unbrained/pm-cli 2026.9.12 while npm latest is 2026.9.17, which fixes telemetry consent/DO_NOT_TRACK handling, telemetry event loss under concurrent queue rewrites, a lock reclaimed during owner-metadata init, oversized item reads losing content without a receipt, and merge-driver launchers breaking after a runtime upgrade. 2026.9.14 also lets non-colliding extension leaves live beneath core command groups. Advance pm-ops to 2026.9.13 and pm-changelog to 2026.9.16 as well."
+type: Chore
+status: closed
+priority: 2
+tags: []
+created_at: "2026-09-17T19:40:00.441Z"
+updated_at: "2026-09-17T19:52:27.070Z"
+closed_at: "2026-09-17T19:52:27.041Z"
+completed_at: "2026-09-17T19:52:27.041Z"
+claim_principal: pi-agent
+author: pi-agent
+acceptance_criteria: "package.json pins @unbrained/pm-cli 2026.9.17 exactly, the lockfile resolves pm-cli 2026.9.17 and pm-ops 2026.9.13 and pm-changelog 2026.9.16, and npm run release:check exits 0 on the new pins"
+resolution: "Advanced @unbrained/pm-cli from 2026.9.12 to 2026.9.17, pm-ops from 2026.9.11 to 2026.9.13, and pm-changelog from 2026.9.9 to 2026.9.16."
+expected_result: "release:check exits 0 on @unbrained/pm-cli 2026.9.17"
+actual_result: "release:check exited 0 on 2026.9.17: 228 of 228 tests pass, coverage 100% line/100% branch across 2 source files, accept:packed ok across npm-current, bun-current, and npm-minimum scenarios, verify:release-publish-attestation ok, verify:release-changelog-date ok"
+files[2]{path,scope}:
+  package.json,project
+  package-lock.json,project
+tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
+  "npm run release:check",project,pi-agent,"2026-09-17T19:52:26.169Z",local_mutation,chore/certify-pm-cli-2026-9-17
+close_reason: Pins advanced to npm latest; all gates pass on the new versions
+body: ""
diff --git a/.agents/pm/history/pm-csv-nkab.jsonl b/.agents/pm/history/pm-csv-nkab.jsonl
@@ -0,0 +1,4 @@
+{"hash_algorithm":"sha256","ts":"2026-09-17T19:40:00.441Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"3da6e4a575607d7bfdab8400","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-csv-nkab"},{"op":"add","path":"/metadata/title","value":"Certify pm CLI 2026.9.17"},{"op":"add","path":"/metadata/description","value":"CI runs the repository-pinned pm binary, so the pin decides what every gate exercises. This repository pins @unbrained/pm-cli 2026.9.12 while npm latest is 2026.9.17, which fixes telemetry consent/DO_NOT_TRACK handling, telemetry event loss under concurrent queue rewrites, a lock reclaimed during owner-metadata init, oversized item reads losing content without a receipt, and merge-driver launchers breaking after a runtime upgrade. 2026.9.14 also lets non-colliding extension leaves live beneath core command groups. Advance pm-ops to 2026.9.13 and pm-changelog to 2026.9.16 as well."},{"op":"add","path":"/metadata/type","value":"Chore"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":[]},{"op":"add","path":"/metadata/created_at","value":"2026-09-17T19:40:00.441Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-09-17T19:40:00.441Z"},{"op":"add","path":"/metadata/author","value":"pi-agent"},{"op":"add","path":"/metadata/acceptance_criteria","value":"package.json pins @unbrained/pm-cli 2026.9.17 exactly, the lockfile resolves pm-cli 2026.9.17 and pm-ops 2026.9.13 and pm-changelog 2026.9.16, and npm run release:check exits 0 on the new pins"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"7c6a258704d7e6e40a3da3865a179ae926e6271e2c2e1eba9121fd7301741161","item_hash_version":3,"message":"","event_class":"substantive","record_hash_version":1,"record_hash":"9f8bf25dc9e88a8c87a8924d3b90852eecd7fd316879899cee71d196aca521a0"}
+{"hash_algorithm":"sha256","ts":"2026-09-17T19:40:04.063Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"3da6e4a575607d7bfdab8400","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-17T19:40:04.063Z"},{"op":"add","path":"/metadata/assignee","value":"pi-agent"},{"op":"add","path":"/metadata/claim_principal","value":"pi-agent"}],"before_hash":"7c6a258704d7e6e40a3da3865a179ae926e6271e2c2e1eba9121fd7301741161","after_hash":"7344ae4e0dd8a1d22df4581d4cc5369d246e644c8d87f793544b69b1620c6ac3","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"55c9f769a117ffe70e18476ca314ed3d98ea3fc2832edf484952bc9d5162f4dc"}
+{"hash_algorithm":"sha256","ts":"2026-09-17T19:52:26.201Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"3da6e4a575607d7bfdab8400","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-09-17T19:52:26.201Z"},{"op":"add","path":"/metadata/files","value":[{"path":"package.json","scope":"project"},{"path":"package-lock.json","scope":"project"}]},{"op":"add","path":"/metadata/tests","value":[{"command":"npm run release:check","scope":"project","provenance":{"author":"pi-agent","created_at":"2026-09-17T19:52:26.169Z","source_kind":"local_mutation","source_ref":"chore/certify-pm-cli-2026-9-17"}}]}],"before_hash":"7344ae4e0dd8a1d22df4581d4cc5369d246e644c8d87f793544b69b1620c6ac3","after_hash":"b53a56a43f79edcd30b18b5882500e6b5a02fc6d7e077d90fabade51a078233c","item_hash_version":3,"event_class":"maintenance","record_hash_version":1,"record_hash":"8b1434462ac4e918510395bdd9dd14e0b799de6f82d80f4377513c6a076f4ce4"}
+{"hash_algorithm":"sha256","ts":"2026-09-17T19:52:27.070Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"glm-5.2:cloud","agent_model_source":"environment","agent_instance":"3da6e4a575607d7bfdab8400","agent_provenance":{"model":{"value":"glm-5.2:cloud","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-09-17T19:52:27.070Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-09-17T19:52:27.041Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-09-17T19:52:27.041Z"},{"op":"add","path":"/metadata/resolution","value":"Advanced @unbrained/pm-cli from 2026.9.12 to 2026.9.17, pm-ops from 2026.9.11 to 2026.9.13, and pm-changelog from 2026.9.9 to 2026.9.16."},{"op":"add","path":"/metadata/expected_result","value":"release:check exits 0 on @unbrained/pm-cli 2026.9.17"},{"op":"add","path":"/metadata/actual_result","value":"release:check exited 0 on 2026.9.17: 228 of 228 tests pass, coverage 100% line/100% branch across 2 source files, accept:packed ok across npm-current, bun-current, and npm-minimum scenarios, verify:release-publish-attestation ok, verify:release-changelog-date ok"},{"op":"add","path":"/metadata/close_reason","value":"Pins advanced to npm latest; all gates pass on the new versions"}],"before_hash":"b53a56a43f79edcd30b18b5882500e6b5a02fc6d7e077d90fabade51a078233c","after_hash":"c54f7d111536edf922bad35c3b5cb741d90c3991068a7512bf5a5520b7f2d271","item_hash_version":3,"event_class":"substantive","record_hash_version":1,"record_hash":"43c012af98a71fa10748cf53b99af849bc5e37fde4a47ce6ad78d5a6e1b35d3f"}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Other
+
+- Certify pm CLI 2026.9.17 ([pm-csv-nkab](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/chores/pm-csv-nkab.toon))
+
 ## 2026.9.13 - 2026-09-13
 
 ### Other
@@ -44,18 +50,24 @@
 
 - Consume the canonical publish-attestation gate instead of carrying a copy of it ([pm-csv-orot](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/chores/pm-csv-orot.toon))
 
+## 2026.9.1 - 2026-09-01
+
+### Fixed
+
+- Pin pm-changelog 2026.8.30 before the next release ([pm-csv-vc26](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-vc26.toon))
+
 ## 2026.8.31 - 2026-08-31
 
 ### Fixed
 
 - Keep CodeQL action updates synchronized in one pull request ([pm-csv-tbxy](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-tbxy.toon))
 - Rebase the changelog date verifier onto the current release workflow ([pm-csv-bnra](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-bnra.toon))
-- Pin pm-changelog 2026.8.30 before the next release ([pm-csv-vc26](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-vc26.toon))
 
 ## 2026.8.29 - 2026-08-29
 
 ### Fixed
 
+- A failed provenance publish silently falls back to an unattested one ([pm-csv-nb1m](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-nb1m.toon))
 - Fix joinContinuations whitespace, add action.yml to EXECUTABLE_PATHS, and skip value-flag args in isPublishCommand ([pm-csv-v9cs](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-v9cs.toon))
 - The publish-attestation gate misses a publish routed through an unquoted shell variable ([pm-csv-ab5t](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-ab5t.toon))
 
@@ -67,7 +79,6 @@
 
 ### Fixed
 
-- A failed provenance publish silently falls back to an unattested one ([pm-csv-nb1m](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-nb1m.toon))
 - Changelog scripts consume bounded tracker output and erase release history ([pm-csv-zmcb](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-zmcb.toon))
 - Adopt the canonical certified complete-list reader ([pm-csv-t4cc](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-t4cc.toon))
 - Resume reader comment falsely permits empty map on list-all failure ([pm-csv-u254](https://github.com/unbraind/pm-csv/blob/main/.agents/pm/issues/pm-csv-u254.toon))

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -67,12 +67,12 @@
     "@babel/eslint-parser": "^8.0.1",
     "@babel/plugin-syntax-typescript": "^8.0.3",
     "@types/node": "^26.1.1",
-    "@unbrained/pm-cli": "2026.9.12",
+    "@unbrained/pm-cli": "2026.9.17",
     "eslint": "^10.8.1",
     "jiti": "^2.7.0",
     "jscpd": "^5.0.16",
-    "pm-changelog": "2026.9.9",
-    "pm-ops": "^2026.9.11",
+    "pm-changelog": "2026.9.16",
+    "pm-ops": "2026.9.13",
     "typescript": "^7.0.2",
     "yaml": "2.9.0"
   },