diff --git a/.agents/pm/features/pm-github-z5z1.toon b/.agents/pm/features/pm-github-z5z1.toon index aeaca763..e9bb1275 100644 --- a/.agents/pm/features/pm-github-z5z1.toon +++ b/.agents/pm/features/pm-github-z5z1.toon @@ -2,11 +2,13 @@ id: pm-github-z5z1 title: Let reusable sync choose its npm project directory description: "GitHub issue: https://github.com/unbraind/pm-github/issues/129. Add optional npm-project-dir (default .), validate a repository-contained npm project before installation, and use it for dependencies, CLI PATH, and the caller post-import script without expanding the publication allowlist." type: Feature -status: in_progress +status: closed priority: 1 tags: [] created_at: "2026-10-15T17:57:16.378Z" -updated_at: "2026-10-15T20:00:59.345Z" +updated_at: "2026-10-16T06:24:40.941Z" +closed_at: "2026-10-16T06:24:40.911Z" +completed_at: "2026-10-15T20:27:49.000Z" author: codex-agent comments[11]{created_at,author,text}: "2026-10-15T17:57:29.182Z",codex-agent,"Design: validate npm-project-dir after checkout and before setup-node caching or npm install; reject absolute/traversal paths, resolved symlink escapes, missing package.json, and environment/PATH separators with one named-input diagnostic. Export the canonical project path for install, PATH and the post-import script; resolve the SDK there while keeping tracker and Git operations at the repository root. Preserve the publication allowlist. Contract tests execute shell extracted from the real workflow with real temporary projects; perform and record a behavioral revert per regression scenario." @@ -32,4 +34,5 @@ tests[4]{command,scope,timeout_seconds,provenance{author,created_at,source_kind, docs[2]{path,scope}: docs/sync-workflow-caller.yml,project README.md,project +close_reason: "{\"pr\":130,\"url\":\"https://github.com/unbraind/pm-github/pull/130\",\"merge_commit_sha\":\"3f64d8b510df98462774276ca34fbf65a0d64481\",\"head_sha\":\"a8404e843baf0c7cbc811c849258b58838b5bf41\",\"merged_at\":\"2026-10-15T20:27:49Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}" body: "" diff --git a/.agents/pm/history/pm-github-0x3y.jsonl b/.agents/pm/history/pm-github-0x3y.jsonl index c61cc76d..edd091e0 100644 --- a/.agents/pm/history/pm-github-0x3y.jsonl +++ b/.agents/pm/history/pm-github-0x3y.jsonl @@ -31,3 +31,5 @@ {"hash_algorithm":"sha256","ts":"2026-10-16T05:19:04.632Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/15","value":{"created_at":"2026-10-16T05:19:04.632Z","author":"codex-agent","text":"Fresh bun run release:check passed: 702/702 tests, zero failures/skips/cancellations/todos; all 13 authored modules have exact 100/100/100/100 coverage (10068/10068 lines and statements, 256/256 functions, 2845/2845 branches). Typecheck/build/docstrings/lint, zero duplication, privacy, production audit, pack, changelog check and release attestation all passed. The previously missed output branches now execute in direct handler tests. Latest origin/main is already contained. Starting the final npm release gate at unchanged thresholds."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:19:04.632Z"}],"before_hash":"9248e90dc3ef35c2ac1560ef42eb932af6f44de593fa56b39eae9943ee6f6b95","after_hash":"3cc44c061fded9faa3da00b78fdc3d99365451c4740da18c8e6c57e18ee98b6e","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"2ee50f1b95982139e8c67b6c50f1574d047e3bc82af8fa541388bc0f71c6770c"} {"hash_algorithm":"sha256","ts":"2026-10-16T05:52:03.065Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/16","value":{"created_at":"2026-10-16T05:52:03.065Z","author":"codex-agent","text":"Final npm run release:check and bun run release:check both passed with isolated HOME/Git identity: 702/702 tests each; zero failures, skips, cancellations or todos; exact 100/100/100/100 coverage across all 13 authored modules (10068 lines/statements, 256 functions, 2845 branches, all covered). All remaining release checks passed at unchanged thresholds and dependency pins. Revert baseline b3b5f33: node --test --test-name-pattern='unavailable evidence.*(unlinked|incomplete)' test/closeout-workflow.test.ts failed 3/3 selected regressions with only the original workflow evidence predicate restored. After restoring only uncompacted report behaviour and rebuilding, node --test --test-name-pattern='compact report|packed CLI' test/closeout.test.ts failed 2/2 selected regressions. Fixes restored before successful gates. The workflow's exact summary projection on the captured real pm-brief report yields 2 actionable rows and skip counts already_terminal=9, other_repository=35, duplicate_selection=1. Default output is 76 to 25 lines; all 47 rows remain in JSON/full output. Caller pins must target a release emitting decision codes. Releasing the claim for orchestrator verification; the item remains in_progress."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:52:03.065Z"}],"before_hash":"3cc44c061fded9faa3da00b78fdc3d99365451c4740da18c8e6c57e18ee98b6e","after_hash":"b54c1241658d7bffc69a63c6d743063464d18b90d9b04e4a3e4bf44f2f539fbd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"d1038bd70c99d98527a4d19cdf0bf3f41e1ae85e3961c35df18afd62bd9ff81a"} {"hash_algorithm":"sha256","ts":"2026-10-16T05:52:04.621Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:52:04.621Z"}],"before_hash":"b54c1241658d7bffc69a63c6d743063464d18b90d9b04e4a3e4bf44f2f539fbd","after_hash":"895a94f83bb7bc6448c8d2b1a86c591f516d71fc973c0c7d51d76281b2b314d4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"58e56b56bbde29f6fc3990fa6992887959e2bd9c428c36a3d9a963fa57560875"} +{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:31.524Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:31.524Z"},{"op":"add","path":"/metadata/tags/0","value":"added"}],"before_hash":"895a94f83bb7bc6448c8d2b1a86c591f516d71fc973c0c7d51d76281b2b314d4","after_hash":"6b66de58879972ad982446c80e33943adaccaa3ab7aebb2cc6c95e78571cbb4d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"1011f7902c06a0cf22e9ed4f90bd358c50b1afb8927792d623c573397176ca0d"} +{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:41.057Z","author":"pm-github","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"close","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:41.057Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-16T06:24:41.045Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-16T06:22:47.000Z"},{"op":"add","path":"/metadata/close_reason","value":"{\"pr\":132,\"url\":\"https://github.com/unbraind/pm-github/pull/132\",\"merge_commit_sha\":\"4c1beafbacb4a51c6a92301a41a0b6c310658ac2\",\"head_sha\":\"6aef689f20b0758a25be1b9821877052d985049b\",\"merged_at\":\"2026-10-16T06:22:47Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"}],"before_hash":"6b66de58879972ad982446c80e33943adaccaa3ab7aebb2cc6c95e78571cbb4d","after_hash":"7f148f16d34765a0f1f9c1937974dd7171ca5b294c3e1274f294a171c17e47c7","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"e3d81a7509fe24a3f9a9be747d920d926186955e1dc30380a4aad7850a688718"} diff --git a/.agents/pm/history/pm-github-q4uz.jsonl b/.agents/pm/history/pm-github-q4uz.jsonl index fde21cd9..86563f93 100644 --- a/.agents/pm/history/pm-github-q4uz.jsonl +++ b/.agents/pm/history/pm-github-q4uz.jsonl @@ -22,3 +22,4 @@ {"hash_algorithm":"sha256","ts":"2026-10-16T00:12:16.006Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-16T00:12:16.006Z","author":"codex-agent","text":"Final npm run release:check passed under isolated HOME/Git configuration: 681/681 tests, zero failures/skips/cancellations/todos. Thirteen authored modules have exact 100/100/100/100 coverage: 10040/10040 lines and statements, 255/255 functions, 2832/2832 branches, zero skipped source. Static checks, privacy, zero-duplication threshold, production audit (0 vulnerabilities), pack, changelog and attestation all passed unchanged. Final linked PM tests also passed 7/7 via node_modules/.bin/pm test pm-github-q4uz --run --progress --timeout 600. The identical-tree Bun copy has passed 681/681 tests; its coverage merge is now running after npm aggregation, limiting concurrent merge memory."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:12:16.006Z"}],"before_hash":"2cea3e2dc981aaafa321ea68e2f8dcf7d26c6c29e8ebe3004d8723b70de86a2f","after_hash":"12e29fcd47f82ed970a9153b431d9da5c7b717c7c244aa5d7227b8a84bd28f10","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"0dda4792add87e5d293be58f579257633945b2a2ba10d8d15e9e35c0938b07ad"} {"hash_algorithm":"sha256","ts":"2026-10-16T00:16:44.905Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-16T00:16:44.905Z","author":"codex-agent","text":"Round 1 complete: npm run release:check and bun run release:check both passed 681/681 tests, zero failures/skips/cancellations/todos, under isolated HOME/Git configuration. The Bun validation copy exactly matched staged Git tree 1e8657e1bd73999c0b25f6dac70534280ca4f243; source and docs still match that tree, with only later tracker evidence additions. Both receipts match: 13 authored modules, 10040/10040 lines and statements, 255/255 functions, 2832/2832 branches, exact 100/100/100/100 with no skipped source. Static, privacy, zero-duplication, production audit, pack, changelog and attestation gates all passed unchanged. Final linked PM tests passed 7/7; focused attestation tests passed 8/8. All three review threads are valid, with the two non-main threads sharing one fix and proof. Current PATH-seam reverts fail 0/1 for payload-only schedule resolution and 0/2 for origin/main preparation; restored tests pass. No main literal remains in the reusable workflow. Caller repinning remains necessary; live caller schedules were not changed or executed. No PM CLI/SDK defect identified; files/docs additions take one value per call. Releasing the claim and leaving the item in_progress for orchestrator verification; no review-thread replies/resolutions or mentions were sent."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:16:44.905Z"}],"before_hash":"12e29fcd47f82ed970a9153b431d9da5c7b717c7c244aa5d7227b8a84bd28f10","after_hash":"91efedc3dddbab0073acdf35d4b6c3d3f0431c8a059450eae904872c998d7f64","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5603f133513c4f39ec1c09a59ac191745b3ca7c7ff9183a61694caf08e97cde9"} {"hash_algorithm":"sha256","ts":"2026-10-16T00:16:46.640Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:16:46.640Z"}],"before_hash":"91efedc3dddbab0073acdf35d4b6c3d3f0431c8a059450eae904872c998d7f64","after_hash":"132330901d3c1886a1319d00eda0fe24b25ca5b3021316958c8a0ecdf62cf29b","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"85d1d86dc1d8da85a94f08d8e0861c6500c1fb3bc1cfc9b5cf3070f47770ae3b"} +{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:41.008Z","author":"pm-github","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"close","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:41.008Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-16T06:24:40.999Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-16T00:42:36.000Z"},{"op":"add","path":"/metadata/close_reason","value":"{\"pr\":131,\"url\":\"https://github.com/unbraind/pm-github/pull/131\",\"merge_commit_sha\":\"bf282dd0c1608bb8e979af3c8792bdeed0f4a026\",\"head_sha\":\"9feb31f62bec59d68b2e147070d9486b3a7e8db2\",\"merged_at\":\"2026-10-16T00:42:36Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"Sourcery review\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"}],"before_hash":"132330901d3c1886a1319d00eda0fe24b25ca5b3021316958c8a0ecdf62cf29b","after_hash":"7f432472646b52614e202c4e1fd70a81f1f4e2a0963fa1d3e10c22e9d2f1a08f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"73b84cc70718b0c7655ea7e491dc3b015d75616d7ce6da28b92ac4e1fbcb811a"} diff --git a/.agents/pm/history/pm-github-z5z1.jsonl b/.agents/pm/history/pm-github-z5z1.jsonl index c70119eb..623da272 100644 --- a/.agents/pm/history/pm-github-z5z1.jsonl +++ b/.agents/pm/history/pm-github-z5z1.jsonl @@ -26,3 +26,4 @@ {"hash_algorithm":"sha256","ts":"2026-10-15T20:00:57.101Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e520be6a6f7950145f419269","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-15T20:00:57.101Z","author":"codex-agent","text":"Final delivery gates passed on the final implementation: npm run release:check exit 0 and bun run release:check exit 0, each with a fresh HOME and GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1. Both ran 676/676 tests, zero failures/skips/cancellations/todo. Each measured 13 authored modules with exact 10040/10040 lines, 10040/10040 statements, 255/255 functions and 2832/2832 branches; no skipped source. Thresholds and dependency pins are unchanged. Docstrings 12 files/158 declarations; duplication zero across 13 modules/10036 lines; privacy 4453 objects approved; production audit zero vulnerabilities; package dry-run, changelog and publication-attestation checks pass."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-15T20:00:57.101Z"}],"before_hash":"b80bb890e1bfaa6ee99550caff9fbc57fdfea897d0e5d5119419b64576ef0cf1","after_hash":"0c4b1fb78983b513ebef84ea078d7f253e9b9182f8212201b595433090b48c6f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"138dd632553780aa3d342c992de763b58c0f2a5ea30fc6ee30092cf855db2ced"} {"hash_algorithm":"sha256","ts":"2026-10-15T20:00:58.048Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e520be6a6f7950145f419269","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-15T20:00:58.048Z","author":"codex-agent","text":"Implementation, caller documentation, 13 feature tests, 8 attestation tests and all 9 behavioral controls (18 expected failures) are complete. Releasing the claim for orchestrator review; the item remains nonterminal. Remaining boundary: hosted PR checks and a released/caller-repinned workflow are not established by these local gates. PM CLI gaps encountered are documented above; no upstream CLI reports were filed."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-15T20:00:58.048Z"}],"before_hash":"0c4b1fb78983b513ebef84ea078d7f253e9b9182f8212201b595433090b48c6f","after_hash":"83ac23591fba39a24bdb36b0e870e952fec42365bd730ab8a4c29c5e8bf994e1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"a5454bb029855c420f7d67e02611d3805219c929f910eac8c2d8364cd7c4a68e"} {"hash_algorithm":"sha256","ts":"2026-10-15T20:00:59.345Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"e520be6a6f7950145f419269","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-15T20:00:59.345Z"}],"before_hash":"83ac23591fba39a24bdb36b0e870e952fec42365bd730ab8a4c29c5e8bf994e1","after_hash":"fbcfbed8315fddb3ddcc9d732cca3c74e16756884d9823baa047c1dcb4c3fe53","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"4ecacd4d07cf293a717e2b4beb7e97f77db6d148907df6833fb01ad4b941f9f9"} +{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:40.941Z","author":"pm-github","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"close","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:40.941Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-16T06:24:40.911Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-15T20:27:49.000Z"},{"op":"add","path":"/metadata/close_reason","value":"{\"pr\":130,\"url\":\"https://github.com/unbraind/pm-github/pull/130\",\"merge_commit_sha\":\"3f64d8b510df98462774276ca34fbf65a0d64481\",\"head_sha\":\"a8404e843baf0c7cbc811c849258b58838b5bf41\",\"merged_at\":\"2026-10-15T20:27:49Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"}],"before_hash":"fbcfbed8315fddb3ddcc9d732cca3c74e16756884d9823baa047c1dcb4c3fe53","after_hash":"cc287da5ba311ce166bb43148511d156eeaa6c71d8a47a8dea8f7a8d12fe4ca4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"97b0ddc1e42a40a07c3d640b72116c28854e6f55ed87e025c9089f98cb2ad037"} diff --git a/.agents/pm/issues/pm-github-q4uz.toon b/.agents/pm/issues/pm-github-q4uz.toon index 6bf9720f..e3f5b292 100644 --- a/.agents/pm/issues/pm-github-q4uz.toon +++ b/.agents/pm/issues/pm-github-q4uz.toon @@ -2,11 +2,13 @@ id: pm-github-q4uz title: Refuse reusable sync runs outside the caller default branch description: "Track https://github.com/unbraind/pm-github/issues/128. Add a first-step fail-closed ref guard with injection-safe environment inputs, document caller behavior, and execute real workflow shell contract tests without changing the remaining pipeline." type: Issue -status: in_progress +status: closed priority: 1 tags[1]: "gh:unbraind/pm-github#128" created_at: "2026-10-15T20:46:41.947Z" -updated_at: "2026-10-16T00:16:46.640Z" +updated_at: "2026-10-16T06:24:41.008Z" +closed_at: "2026-10-16T06:24:40.999Z" +completed_at: "2026-10-16T00:42:36.000Z" author: codex-agent acceptance_criteria: First-step guard refuses non-default refs and accepts schedule and workflow_dispatch on the default branch; behavioural revert fails; npm and Bun release gates pass at unchanged thresholds. comments[11]{created_at,author,text}: @@ -29,4 +31,5 @@ tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}: docs[2]{path,scope}: docs/sync-workflow-caller.yml,project README.md,project +close_reason: "{\"pr\":131,\"url\":\"https://github.com/unbraind/pm-github/pull/131\",\"merge_commit_sha\":\"bf282dd0c1608bb8e979af3c8792bdeed0f4a026\",\"head_sha\":\"9feb31f62bec59d68b2e147070d9486b3a7e8db2\",\"merged_at\":\"2026-10-16T00:42:36Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"Sourcery review\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}" body: "" diff --git a/.agents/pm/tasks/pm-github-0x3y.toon b/.agents/pm/tasks/pm-github-0x3y.toon index 8cfc1c57..00d35b4d 100644 --- a/.agents/pm/tasks/pm-github-0x3y.toon +++ b/.agents/pm/tasks/pm-github-0x3y.toon @@ -2,11 +2,13 @@ id: pm-github-0x3y title: Add a reusable gated closeout PR workflow description: Follow up on pm-github closeout with a workflow_call automation surface after command acceptance. Reuse the gated sync safety model without changing its existing workflow or inputs. type: Task -status: in_progress +status: closed priority: 2 -tags: [] +tags[1]: added created_at: "2026-10-14T21:46:44.372Z" -updated_at: "2026-10-16T05:52:04.621Z" +updated_at: "2026-10-16T06:24:41.057Z" +closed_at: "2026-10-16T06:24:41.045Z" +completed_at: "2026-10-16T06:22:47.000Z" author: codex-agent acceptance_criteria: "Run verified closeout on a bot branch and open or update a PR; never push main; validate tracker privacy, regenerate changelog, and dispatch required CI before publication.; Test clean, malicious, no-op, permission-limited and repeat invocations with explicit evidence; document least-privilege callers." comments[17]{created_at,author,text}: @@ -42,4 +44,5 @@ tests[5]{command,scope,timeout_seconds,provenance{author,created_at,source_kind, docs[2]{path,scope}: docs/closeout-workflow-caller.yml,project README.md,project +close_reason: "{\"pr\":132,\"url\":\"https://github.com/unbraind/pm-github/pull/132\",\"merge_commit_sha\":\"4c1beafbacb4a51c6a92301a41a0b6c310658ac2\",\"head_sha\":\"6aef689f20b0758a25be1b9821877052d985049b\",\"merged_at\":\"2026-10-16T06:22:47Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}" body: "" diff --git a/CHANGELOG.md b/CHANGELOG.md index e2f87c9c..0c5e7ad9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,16 @@ # Changelog +## Unreleased + +### Added + +- Add a reusable gated closeout PR workflow ([pm-github-0x3y](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-0x3y.toon)) +- Let reusable sync choose its npm project directory ([pm-github-z5z1](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-z5z1.toon)) + +### Fixed + +- Refuse reusable sync runs outside the caller default branch ([pm-github-q4uz](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-q4uz.toon)) + ## 2026.10.15 - 2026-10-15 ### Added