Close tracker items delivered by merged pull requests (2026-10-16)

.agents/pm/features/pm-github-z5z1.toon

@@ -2,11 +2,13 @@ id: pm-github-z5z1
 title: Let reusable sync choose its npm project directory
 description: "GitHub issue: https://github.com/unbraind/pm-github/issues/129. Add optional npm-project-dir (default .), validate a repository-contained npm project before installation, and use it for dependencies, CLI PATH, and the caller post-import script without expanding the publication allowlist."
 type: Feature
-status: in_progress
+status: closed
 priority: 1
 tags: []
 created_at: "2026-10-15T17:57:16.378Z"
-updated_at: "2026-10-15T20:00:59.345Z"
+updated_at: "2026-10-16T06:24:40.941Z"
+closed_at: "2026-10-16T06:24:40.911Z"
+completed_at: "2026-10-15T20:27:49.000Z"
 author: codex-agent
 comments[11]{created_at,author,text}:
   "2026-10-15T17:57:29.182Z",codex-agent,"Design: validate npm-project-dir after checkout and before setup-node caching or npm install; reject absolute/traversal paths, resolved symlink escapes, missing package.json, and environment/PATH separators with one named-input diagnostic. Export the canonical project path for install, PATH and the post-import script; resolve the SDK there while keeping tracker and Git operations at the repository root. Preserve the publication allowlist. Contract tests execute shell extracted from the real workflow with real temporary projects; perform and record a behavioral revert per regression scenario."
@@ -32,4 +34,5 @@ tests[4]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,
 docs[2]{path,scope}:
   docs/sync-workflow-caller.yml,project
   README.md,project
+close_reason: "{\"pr\":130,\"url\":\"https://github.com/unbraind/pm-github/pull/130\",\"merge_commit_sha\":\"3f64d8b510df98462774276ca34fbf65a0d64481\",\"head_sha\":\"a8404e843baf0c7cbc811c849258b58838b5bf41\",\"merged_at\":\"2026-10-15T20:27:49Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"
 body: ""

.agents/pm/history/pm-github-0x3y.jsonl

@@ -31,3 +31,5 @@
 {"hash_algorithm":"sha256","ts":"2026-10-16T05:19:04.632Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/15","value":{"created_at":"2026-10-16T05:19:04.632Z","author":"codex-agent","text":"Fresh bun run release:check passed: 702/702 tests, zero failures/skips/cancellations/todos; all 13 authored modules have exact 100/100/100/100 coverage (10068/10068 lines and statements, 256/256 functions, 2845/2845 branches). Typecheck/build/docstrings/lint, zero duplication, privacy, production audit, pack, changelog check and release attestation all passed. The previously missed output branches now execute in direct handler tests. Latest origin/main is already contained. Starting the final npm release gate at unchanged thresholds."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:19:04.632Z"}],"before_hash":"9248e90dc3ef35c2ac1560ef42eb932af6f44de593fa56b39eae9943ee6f6b95","after_hash":"3cc44c061fded9faa3da00b78fdc3d99365451c4740da18c8e6c57e18ee98b6e","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"2ee50f1b95982139e8c67b6c50f1574d047e3bc82af8fa541388bc0f71c6770c"}
 {"hash_algorithm":"sha256","ts":"2026-10-16T05:52:03.065Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/16","value":{"created_at":"2026-10-16T05:52:03.065Z","author":"codex-agent","text":"Final npm run release:check and bun run release:check both passed with isolated HOME/Git identity: 702/702 tests each; zero failures, skips, cancellations or todos; exact 100/100/100/100 coverage across all 13 authored modules (10068 lines/statements, 256 functions, 2845 branches, all covered). All remaining release checks passed at unchanged thresholds and dependency pins. Revert baseline b3b5f33: node --test --test-name-pattern='unavailable evidence.*(unlinked|incomplete)' test/closeout-workflow.test.ts failed 3/3 selected regressions with only the original workflow evidence predicate restored. After restoring only uncompacted report behaviour and rebuilding, node --test --test-name-pattern='compact report|packed CLI' test/closeout.test.ts failed 2/2 selected regressions. Fixes restored before successful gates. The workflow's exact summary projection on the captured real pm-brief report yields 2 actionable rows and skip counts already_terminal=9, other_repository=35, duplicate_selection=1. Default output is 76 to 25 lines; all 47 rows remain in JSON/full output. Caller pins must target a release emitting decision codes. Releasing the claim for orchestrator verification; the item remains in_progress."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:52:03.065Z"}],"before_hash":"3cc44c061fded9faa3da00b78fdc3d99365451c4740da18c8e6c57e18ee98b6e","after_hash":"b54c1241658d7bffc69a63c6d743063464d18b90d9b04e4a3e4bf44f2f539fbd","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"d1038bd70c99d98527a4d19cdf0bf3f41e1ae85e3961c35df18afd62bd9ff81a"}
 {"hash_algorithm":"sha256","ts":"2026-10-16T05:52:04.621Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"27925bf5cb01cdb497b58c21","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T05:52:04.621Z"}],"before_hash":"b54c1241658d7bffc69a63c6d743063464d18b90d9b04e4a3e4bf44f2f539fbd","after_hash":"895a94f83bb7bc6448c8d2b1a86c591f516d71fc973c0c7d51d76281b2b314d4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"58e56b56bbde29f6fc3990fa6992887959e2bd9c428c36a3d9a963fa57560875"}
+{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:31.524Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:31.524Z"},{"op":"add","path":"/metadata/tags/0","value":"added"}],"before_hash":"895a94f83bb7bc6448c8d2b1a86c591f516d71fc973c0c7d51d76281b2b314d4","after_hash":"6b66de58879972ad982446c80e33943adaccaa3ab7aebb2cc6c95e78571cbb4d","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"1011f7902c06a0cf22e9ed4f90bd358c50b1afb8927792d623c573397176ca0d"}
+{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:41.057Z","author":"pm-github","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"close","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:41.057Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-16T06:24:41.045Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-16T06:22:47.000Z"},{"op":"add","path":"/metadata/close_reason","value":"{\"pr\":132,\"url\":\"https://github.com/unbraind/pm-github/pull/132\",\"merge_commit_sha\":\"4c1beafbacb4a51c6a92301a41a0b6c310658ac2\",\"head_sha\":\"6aef689f20b0758a25be1b9821877052d985049b\",\"merged_at\":\"2026-10-16T06:22:47Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"}],"before_hash":"6b66de58879972ad982446c80e33943adaccaa3ab7aebb2cc6c95e78571cbb4d","after_hash":"7f148f16d34765a0f1f9c1937974dd7171ca5b294c3e1274f294a171c17e47c7","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"e3d81a7509fe24a3f9a9be747d920d926186955e1dc30380a4aad7850a688718"}

.agents/pm/history/pm-github-q4uz.jsonl

@@ -22,3 +22,4 @@
 {"hash_algorithm":"sha256","ts":"2026-10-16T00:12:16.006Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/9","value":{"created_at":"2026-10-16T00:12:16.006Z","author":"codex-agent","text":"Final npm run release:check passed under isolated HOME/Git configuration: 681/681 tests, zero failures/skips/cancellations/todos. Thirteen authored modules have exact 100/100/100/100 coverage: 10040/10040 lines and statements, 255/255 functions, 2832/2832 branches, zero skipped source. Static checks, privacy, zero-duplication threshold, production audit (0 vulnerabilities), pack, changelog and attestation all passed unchanged. Final linked PM tests also passed 7/7 via node_modules/.bin/pm test pm-github-q4uz --run --progress --timeout 600. The identical-tree Bun copy has passed 681/681 tests; its coverage merge is now running after npm aggregation, limiting concurrent merge memory."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:12:16.006Z"}],"before_hash":"2cea3e2dc981aaafa321ea68e2f8dcf7d26c6c29e8ebe3004d8723b70de86a2f","after_hash":"12e29fcd47f82ed970a9153b431d9da5c7b717c7c244aa5d7227b8a84bd28f10","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"0dda4792add87e5d293be58f579257633945b2a2ba10d8d15e9e35c0938b07ad"}
 {"hash_algorithm":"sha256","ts":"2026-10-16T00:16:44.905Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/10","value":{"created_at":"2026-10-16T00:16:44.905Z","author":"codex-agent","text":"Round 1 complete: npm run release:check and bun run release:check both passed 681/681 tests, zero failures/skips/cancellations/todos, under isolated HOME/Git configuration. The Bun validation copy exactly matched staged Git tree 1e8657e1bd73999c0b25f6dac70534280ca4f243; source and docs still match that tree, with only later tracker evidence additions. Both receipts match: 13 authored modules, 10040/10040 lines and statements, 255/255 functions, 2832/2832 branches, exact 100/100/100/100 with no skipped source. Static, privacy, zero-duplication, production audit, pack, changelog and attestation gates all passed unchanged. Final linked PM tests passed 7/7; focused attestation tests passed 8/8. All three review threads are valid, with the two non-main threads sharing one fix and proof. Current PATH-seam reverts fail 0/1 for payload-only schedule resolution and 0/2 for origin/main preparation; restored tests pass. No main literal remains in the reusable workflow. Caller repinning remains necessary; live caller schedules were not changed or executed. No PM CLI/SDK defect identified; files/docs additions take one value per call. Releasing the claim and leaving the item in_progress for orchestrator verification; no review-thread replies/resolutions or mentions were sent."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:16:44.905Z"}],"before_hash":"12e29fcd47f82ed970a9153b431d9da5c7b717c7c244aa5d7227b8a84bd28f10","after_hash":"91efedc3dddbab0073acdf35d4b6c3d3f0431c8a059450eae904872c998d7f64","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"5603f133513c4f39ec1c09a59ac191745b3ca7c7ff9183a61694caf08e97cde9"}
 {"hash_algorithm":"sha256","ts":"2026-10-16T00:16:46.640Z","author":"codex-agent","author_source":"asserted","agent_harness":"codex","agent_model":"gpt-6.1-sol","agent_model_source":"probe","agent_instance":"3f4d07134bb3ca98e61c91e7","agent_provenance":{"model":{"value":"gpt-6.1-sol","source":"probe"},"effort":{"value":"high","source":"probe"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T00:16:46.640Z"}],"before_hash":"91efedc3dddbab0073acdf35d4b6c3d3f0431c8a059450eae904872c998d7f64","after_hash":"132330901d3c1886a1319d00eda0fe24b25ca5b3021316958c8a0ecdf62cf29b","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"effort":{"status":"resolved","resolver":"codex_session_file","rule_version":"v1"},"version":{"status":"unavailable","reason":"harness_unavailable","resolver":"ai_agent_version","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"85d1d86dc1d8da85a94f08d8e0861c6500c1fb3bc1cfc9b5cf3070f47770ae3b"}
+{"hash_algorithm":"sha256","ts":"2026-10-16T06:24:41.008Z","author":"pm-github","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"cd687996088c07eef02d762c","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"xhigh","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.301","source":"probe"}},"op":"close","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-16T06:24:41.008Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-16T06:24:40.999Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-16T00:42:36.000Z"},{"op":"add","path":"/metadata/close_reason","value":"{\"pr\":131,\"url\":\"https://github.com/unbraind/pm-github/pull/131\",\"merge_commit_sha\":\"bf282dd0c1608bb8e979af3c8792bdeed0f4a026\",\"head_sha\":\"9feb31f62bec59d68b2e147070d9486b3a7e8db2\",\"merged_at\":\"2026-10-16T00:42:36Z\",\"checks\":[\"CodeQL\",\"CodeRabbit\",\"Sourcery review\",\"codeql\",\"semgrep-cloud-platform/scan\",\"test (22)\",\"test (26)\"]}"}],"before_hash":"132330901d3c1886a1319d00eda0fe24b25ca5b3021316958c8a0ecdf62cf29b","after_hash":"7f432472646b52614e202c4e1fd70a81f1f4e2a0963fa1d3e10c22e9d2f1a08f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"73b84cc70718b0c7655ea7e491dc3b015d75616d7ce6da28b92ac4e1fbcb811a"}